Full disclosure: The only protocol for net security
It can be hard in business to distinguish between greed, laziness, incompetence and wilful ignorance.
One or more of these is better than any technical analysis in explaining the latest 'worst internet threat', revealed at the DefCon hackers' conference in August. The flaw is that BGP, the Border Gateway Protocol used to route inter-ISP data, can be hoodwinked into sending traffic through a unauthorised third party, potentially delivering enormous amounts of traffic to snoopers — or cutting it off altogether.
That's bad enough. What's worse is that the vulnerabilities in BGP have been known for many years, and that security analysts have already spent much time at the highest levels trying to get the problem recognised and addressed. There are fixes available, as well as longer-term strategies towards inherently more secure systems, but they take co-operation, time and money. To date, the ISP industry has declined to make that investment.
Which leaves just two paths to getting this fixed. One is for public disclosure to shame the ISPs into taking action, effectively putting commercial pressure on them. The other is to wait for disaster, recrimination and reform. The latter, called gravestone regulation in the aviation industry, is in every case the worse option.
When the proper authorities know of a problem and decline to fix it, full disclosure is the only moral option. Ideally, it becomes the weapon too terrible to use — the threat alone should be enough to cause action.
That is why the right to full exposure should be legally guaranteed, protecting researchers from the threat of disruptive injunction providing proper procedures are followed. We are loath to call for new regulations and new responsibilities, but in the absence of any alternative and in the face of real danger they become the only safeguard against foreseeable disaster.
Full disclosure isn't just a good idea. It should be the law.