Thread by @chrissanders88

As one of my last doctoral coursework presentations, I spent time talking to my colleagues about the ethical dilemmas surrounding offensive security tool release. The outsider input was fascinating. Here's a thread to share some of that... 1/

Now keep in mind, my colleagues here are primarily educators. K-12 and university teachers, administrators, educational researchers, and so on. A few industry-specific education people as well, but none from infosec like me. 2/

My goal was to present the issue, explain why it was an ethical dilemma, and collectively discuss ethical perspectives that could influence decision-making. I withheld any of my opinions to let them form their own but gave lots of examples of OSTs and their use. 3/

I presented 3 typical release options. Open release to the world, no release to anybody, or a limited release to trusted third parties. I think most followers here understand the basic pros and cons of those things. Each option transgresses some moral principle for most folks. 4/

Right off the bat, lots of comments about industry-based ethical standards. We don't have any that everyone is required to uphold, in part because we aren't required to have licenses. Things like medical boards (medicine) and the bar (law) establish these in other fields. 5/

Folks were surprised we don't have more concrete things to fall back on. Most educators have pretty specific ethics/honor codes from their institutions, regional boards, or states. 6/

The place where most of us would be bound to any ethical code are with the certifications we obtain or our workplaces. But, those workplace ethics codes are not likely to apply to this issue unless you work at an infosec company specifically. 7/

We also talked about individual responsibility. I asked if folks would feel responsible if they released a tool used to attack someone else. Most said yes. A key question that arose was the DEGREE of impact from the OST release as well as the CERTAINTY of its use. 8/

I also asked if folks would feel responsible if they developed an OST and did NOT release it, and companies got attacked by a similar adversary tool but could not stop/detect it. Most said no, although some said it depends on the relationship with those victim entities. 9/

Another theme was the notion of scale. Particularly, the level of effort to weaponize an OST versus effort to build protection/detection around it. Also, who gets left behind because of an inability to build defenses against the tool/technique? 10/

Some folks were initially surprised that many small businesses don't have dedicated security people. I referenced some average security salaries and most of them got it pretty quick after that (although that is just one facet of that issue). 11/

We did some exercises around common ethical perspectives. For example, most agreed that a utilitarian view (the most good for the most people) would lean towards the open release of OSTs if you're going with volume-based impact alone. 12/

In another viewpoint, most thought that Kant's Categorical Imperative (what is right for one is right for all) would dictate not releasing OSTs because of the universal principle of doing no harm. 13/

In a pragmatism-based perspective, most said it would be highly situational and you would make the call based on the impacts and perceptions that came from the release of similar OSTs in the past. 14/

Of course, all those perspectives have their drawbacks and most folks apply facets of multiple perspectives in their decision making (even if they don't realize it or know these names for them exist). 15/

We used something called the Lonergan/Baird method to analyze the decision. As part of that, I got a great question... "Do the professional benefits of releasing an OST create some bias?" -- Absolutely! 16/

Releasing OSTs is generally a good career move. It can lead to promotions, better jobs, raises, speaking gigs, consulting opportunities, and more. That can obviously create some biased decision-making. 17/

That's the value of some of these ethical decision-making frameworks. They help you think of topics through different lenses, even if you already know a lot about the topic. We used Lonergan/Baird, Goldman's Four Square, and Badaracco's 5 timeless questions. 18/

There were a lot of great questions I couldn't answer. Things about base rates of attacks, the proliferation of tools, and so on. Things we just don't have numbers on yet. I did reference Paul Litvak's excellent paper here: vb2020.vblocalhost.com/uploads/VB2020….

More of this! 19/

Towards the end, I asked if folks thought that practitioners should start from a place of open release unless they could justify otherwise, or start from a place of no release unless they could justify otherwise. It was about 60/40 in favor of starting from no release. 20/

Other takeaways...
- Nearly everyone thought this would be a case-by-case decision
- Everyone thought that this needs a lot more research
- Nearly everyone was surprised the industry doesn't have more universal ethical standards considering the nature of the work
21/

More takeaways...
- Some were surprised our industry doesn't require any licensure
- Many were surprised to learn that OSTs weren't regulated in some way legally
- Many were surprised to learn that OST release is often a decision made by individuals

22/

We identified some questions that could be answered on a case by case basis to make decisions regarding OST release. I combined the ideas and wrote those out here.

23/

There's a roadmap for a lot of research to be done that informs those decisions.

Also, that second to the last question 🔥🔥🔥

24/

There you have it. Educators are a lot more risk-aware than you might think, but they also approach risk differently. I find that most perspectives are useful but few conclusions are, so do with that what you will.
25/

And for me? My thoughts are still that we need to do a lot more research to understand this topic. I wrote about that here: chrissanders.org/2020/07/resear….

I also created a Socratic framework for discussing OST release in educational environments here: chrissanders.org/2020/07/socrat….

26/

Overall, this was a fun and useful exercise and I learned a lot. At some point I'd love to teach an infosec ethics course to have more of these discussions around this topic and others -- it'd need to be live online or face to face though. A lot of nuances.

27/27