Re:NSO Group's iPhone Zero-Days used against a UAE Human Rig...
by tptacek on Thursday August 25, 2016 @05:51PM
(#12362782)
I don't think you fully follow. The skills can't be regulated: they're pure research. The US research community will continuing doing the fundamental enabling work relied on by exploit developers; it's just the people who do the testing and integration work who'll have to have their paychecks sent to Southeast Asia.
It's a very difficult problem.
There's also some bigtime cognitive availability bias happening here. We read lurid stories centering on "zero-day exploits" and say "something must be done". But no matter what these articles say, it seems cosmically unlikely that an exploit dealer is worth a billion dollars; the entire exploit trade is a rounding error compared to the switching and filtering equipment companies knowingly sell China and Iran for use in putting dissidents to death.
A good point. A couple ideas, though neither is sufficient:
* International agreements control distribution of other dangerous goods; that's doable. However, look at how well that works with drugs, and even nukes get around.
* At least stop sophisticated organizations (defense contractors, SV firms, etc.) from making them for foreign governments. Their skills are harder, though not impossible, to replace. Perhaps ban the sale of exploits - taking away the profit motive - but permit distribution for personal, research, etc. purposes.