A group of 55 cybersecurity specialists, computer scientists, business owners, academics and students are urging Georgia Governor Nathan Deal to veto a hacking crime bill they say will hamper white hat researchers from uncovering security flaws.Georgia State Bill (S.B.) 315 criminalizes “unauthorized computer access,” or actions by anyone who “intentionally accesses a computer or computer network with knowledge that such access is without authority.” Those authorized to use a computer or a network to conduct a “legitimate business activity” or enact cybersecurity “active defense measures” are exempt from the proposed legislation. Neither of the exempt provisions are clearly defined in the bill, making it all the more difficult to determine if Georgia legislators are out front in prosecuting cybercrime or hopelessly uninformed.The legislation was initially proposed in early January, subsequently passed by the state Senate and House and sent to Deal on April 8. He has until May 8 to act on bills that passed the Georgia legislature this year. So far, Deal has not indicated his intentions. Of note, Georgia’s $4.7 billion cybersecurity industry is the third largest in the country.“S.B. 315, as written, creates barriers to cybersecurity research that can damage the state’s information security industry and ultimately make its citizens less safe,” the letter reads. “It gives state approval for dangerous ‘hacking back’ methods that will cause more problems than they solve. The bill is more likely to hurt researchers, professionals, and law-abiding citizens than improve cybersecurity. We urge you to veto this legislation.”
Missing the Mark?
Opponents of the legislation concede that while the bill is well intentioned, it “risks long-term negative consequences for digital security in Georgia and beyond. We are concerned that this legislation will chill security research and harm the state’s cybersecurity industry,” they said in a signed letter. Should Deal sign the bill into law, security vulnerabilities will go undiscovered and undisclosed, making it "easier for bad actors to exploit them,” the signees said.Two significant flaws impair the bill, the letter's authors said:- It’s ambiguous. Because the bill’s authors leave undefined the meaning of "legitimate business activities,” there’s potential “liability for independent researchers that identify and disclose vulnerabilities to improve cybersecurity.” It’s unclear how activities will be categorized as legitimate and how the law will be enforced.
- It’s potentially sneaky. The “active defense” provision, which also is undefined, could give companies the legal right to “hack back” or initiate countermeasures to surveil independent researchers, users whose devices have been infected or innocent bystanders.
