Sweeping Georgia cybercrime bill would target 'snoopers'

So it’s an “Anti-Whistleblower” law. What the hell are these scumbags trying to hide now?

Here's commentary from the Atl Biz Chron artciel (behind paywall):

Legislation proposed by the Senate could cripple one of Georgia’s white-hot tech sectors — cybersecurity.

Senate Bill 315, aimed at criminal hackers, is so broadly written critics say it would criminalize the fundamental way cybersecurity researchers find vulnerabilities in websites and tech products. The proposed legislation would have a chilling effect on research, critical to keeping corporation and governments safe from cyberattack.

“Passing a bill to criminalize certain computer activities might make sense, but this bill is way too broad,” said Chris Risley, CEO of Bastille, a cybersecurity firm founded in Atlanta. “Nobody knows where the line is."

Georgia is a top five market for cybersecurity, with more than 115 companies generating more than $4.7 billion in annual revenue, according to the Technology Association of Georgia. Peach State companies employ more than 10,000 network and computer systems engineers.

The bill would put several Atlanta companies -- such as Pindrop, Ionic Security and Bastille -- in violation of state law and liable for criminal penalties. Some companies say they would move their research operations out of the state, if not relocate entirely.

“We have a security research division in Annapolis (Maryland), and we would shift resources there,” Ionic CEO Adam Ghetti said. “It’s not worth the risk to do research in Georgia.”

The impetus for the legislation was an accident involving a student hacking into Kennesaw State University’s compute system, said Sen. Bruce Thompson, R-White, chairman of the Senate Science and Technology committee and the bill’s chief sponsor.

“The (Georgia) Attorney General was having trouble prosecuting them,” Thompson said.

Thompson’s bill would make it a crime to knowingly gain unauthorized access to a computer. The bill’s critics argue that it essentially targets how cybersecurity research is done.

TRENDING COMMERCIAL REAL ESTATE Traffic from internal Amazon website might hint at 'HQ2' derby winner

TRANSPORTATION Expanding Moller-Maersk means UPS has another major competitor UPS was Georgia's second-biggest company of 2017, according to Atlanta Business Chronicle's book of lists, with $60.9 billion in revenues. COMING EVENT Best in Atlanta Real Estate March 1

Researchers anonymously test websites, computer networks and hardware to find vulnerabilities in software code that bad guys can exploit to steal data and take over computers. When vulnerabilities are found, security firms typically alert the affected company and help them patch the bugs before they are found by malicious hackers.

Cybersecurity researches are constantly probing the internet to find vulnerabilities, not because they plan to exploit them, but because if they can access it, so can the bad guys, Risley said.

“If this law passes, threat research will stop in Georgia, but it won’t stop in Russia, or North Korea, or Iran, or China,” he said. “The only difference is that the good guys are warning people and closing these things down; the Russians will keep going.”

Last year, Bastille researchers found a major vulnerability in the encryption used by some high-end wireless keyboards. Even worse, the researchers found the inexpensive keyboards often used in government offices lacked any encryption at all, Risley said.

“Somebody could sit outside a building and record all the keystrokes being tapped into the wireless keyboards being used,” he said.

Under SB 315, finding that vulnerability would have made what San Francisco-based Bastille did a state crime.

“If this law passes, I’ll probably have to move my radio lab out of Georgia,” Risley said, referring to Batsille's engineering division near Georgia Tech.

SB 315 also would make a crime of breaking a Terms of Use (TOU) agreement — that legal mumbo-jumbo we all click through without reading in order to use a piece of software, or a web service.

In an exaggerated example, using a false name on a Facebook account would be a crime in Georgia because Facebook’s TOU requires real names to be used for Facebook accounts.

Thompson argues the legislation is aimed at criminal hacking, not terms of user agreements. While the language in the measure is broad, he said prosecutors have the leeway to interpret it in a way that only targets criminal hackers.

“Every law we have has prosecutorial discretion,” Thompson said.

The senator said he is working with members of the state house of representatives to make changes in the bill that would address the concerns the industry has raised. The bill has been assigned to the House Judiciary Committee.

Oh thank goodness! Everyone I know gets vigorous snoopings almost constantly.

There really was no more pressing or higher calling for the state House to address in this great state of ours.