US wants to remove export controls for hacking tools

The United States government wants to take intrusion software out of the global Wassenaar Arrangement over concerns it could outlaw currently legitimate security tools and research.

Democrat representative to the US Congress, Jim Langevin, said the Obama administration had decided to renegotiate the Wassenaar Arrangement, calling it a "major victory for cyber security".

The decision was the result of concerted lobbying by the IT industry, which won the support of the US Congress. In December last year 125 representatives wrote [pdf] to US president Barack Obama, asking for intrusion software export controls to be removed from the Wassenaar Arrangement.

The US congressman warned, however, that the government's agenda to renegotiate the Wassenaar Arrangement did not mean a successful resolution was ensured, given international cybersecurity policy is a new domain.

Controlled dual-use items listed in the Wassenaar Arrangement that 41 nations have agreed to follow require individuals and organisations to obtain government licenses before exports can go ahead.

In 2013, France and the UK pushed for certain types of software used for information security to be added to the export controlled list.

Although the intention behind the proposal to regulate intrusion and surveillance software was to prevent such tools from falling into the hands of repressive regimes, the export prohibitions were seen as being overly broad and hampering legitimate IT security efforts.

Google last year argued the export controls on intrusion software could have a disastrous effect, as they would require researchers to obtain a license to report or fix software bugs.

Facebook joined Google in criticising the proposed rules, saying they would inhibit information sharing for computer and network security and kill off bug bounty programs.

Uncertainty around the regulations also had a chilling effect on IT security studies, with a UK researcher withholding publication of exploit details for fear of being in breach of the rules.