Pluralistic: Holy CRAP the UN Cybercrime Treaty is a nightmare
Per author, if the treat passes as-is, it will hurt security and stifle speech.
while this treaty creates broad powers to fight things governments dislike, simply by branding them “cybercrime,” it actually undermines the fight against cybercrime itself. Most cybercrime involves exploiting security defects in devices and services – think of ransomware attacks – and the Cybercrime Treaty endangers the security researchers who point out these defects, creating grave criminal liability for the people we rely on to warn us when the tech vendors we rely upon have put us at risk.
This is the granddaddy of tech free speech fights. Since the paper tape days, researchers who discovered defects in critical systems have been intimidated, threatened, sued and even imprisoned for blowing the whistle. Tech giants insist that they should have a veto over who can publish true facts about the defects in their products, and dress up this demand as concern over security.
Time and again, we’ve seen corporations rationalize their way into suppressing or ignoring bug reports.
The idea that users are safer when bugs are kept secret is called “security through obscurity” and no one believes in it – except corporate executives. As Bruce Schneier says, “Anyone can design a system that is so secure that they themselves can’t break it. That doesn’t mean it’s secure – it just means that it’s secure against people stupider than the system’s designer”
the Cybercrime Treaty creates new obligations on signatories to help other countries’ cops and courts silence and punish security researchers who make these true disclosures, ensuring that spies and criminals will know which products aren’t safe to use, but we won’t (until it’s too late)