<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div dir="ltr"></div>
<div dir="ltr">Shared Signals WG</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Would any of you have a perspective that the OECD could benefit from in an interview about “safe harbours” for security researchers? See their asks below? If you have a view you think they would benefit from, I will put forward your name and
contact information. </div>
<div dir="ltr"><br>
</div>
<div dir="ltr">More generally, I think at least one person should speak to OECD about Shared signals as one capability that can help improve security infrastructure more generally. </div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Gail <br>
<br>
Begin forwarded message:<br>
<br>
</div>
<blockquote type="cite">
<div dir="ltr"><b>From:</b> Christine Runnegar via oecditac <oecditac@elists.isoc.org><br>
<b>Date:</b> January 30, 2024 at 6:10:49 PM PST<br>
<b>To:</b> "oecditac@elists.isoc.org List" <oecditac@elists.isoc.org><br>
<b>Subject:</b> <b>[OECD ITAC] [SDE] [request for expert interviews] on security researchers "safe harbours"</b><br>
<b>Reply-To:</b> Christine Runnegar <runnegar@isoc.org><br>
<br>
</div>
</blockquote>
<blockquote type="cite">
<div dir="ltr"> <span style="font-size: 14px;">Hi all.</span>
<div><span style="font-size: 14px;"><br>
</span></div>
<div><span style="font-size: 14px;">We have received a request from the OECD Secretariat for experts from ITAC to participate in an interview about “safe harbours” for security researchers in the context of security vulnerability detection, reporting, mitigation,
etc. </span></div>
<div><span style="font-size: 14px;"><br>
</span></div>
<div><span style="font-size: 14px;">While we are all super busy, given the very important role that security researcher play in Internet security, I hope that we will be able to provide some experts to help the OECD with this work. It would be really helpful
to have good strong policy guidance in this area coming out of the OECD that could be used in other IG fora.</span></div>
<div><span style="font-size: 14px;"><br>
</span></div>
<div><span style="font-size: 14px;">The details are below.</span></div>
<div><span style="font-size: 14px;"><br>
</span></div>
<div><span style="font-size: 14px;">If you are interested, or have suggestions as to who might be interested in helping with this request, would you please let us know.</span></div>
<div><span style="font-size: 14px;"><br>
</span></div>
<div><span style="font-size: 14px;">Best regards,</span></div>
<div><span style="font-size: 14px;">Christine</span></div>
<div><span style="font-size: 14px;"><br>
</span></div>
<div><span style="font-size: 14px;">====</span></div>
<div><span style="font-size: 14px;"><br>
</span></div>
<div><span style="font-size: 14px;">My name is Bénédicte Schmitt. I am working within OECD’s Digital Security and Safety unit, together with Laurent Bernat (CCed) who carried out work in this area (cf at the end of this message). The 2022 OECD Council Recommendation
on the Treatment of Vulnerabilities calls on governments to develop safe harbours to protect security researchers, and to encourage the creation of guidance defining “ethical hacking” with a view to provide a basis for safe harbours.<br>
<br>
</span></div>
<div><span style="font-size: 14px;">I am currently drafting a paper to help OECD Members implement these provisions in their national policies. The first draft will be discussed by the OECD Working Party on Digital Security in May.<br>
</span></div>
<div><span style="font-size: 14px;">I am carrying out interviews of experts involved in vulnerability disclosure to best inform this work and ensure a balanced and neutral outcome.<br>
<br>
</span></div>
<div><span style="font-size: 14px;">Interviewed experts will not be mentioned in the paper, apart from a generic acknowledgement in the foreword which may be pseudonimised or even anonymized.<br>
</span></div>
<div><span style="font-size: 14px;">Would you be available for a 1h interview on these topic? Here are examples of questions we could discuss:<br>
· What protection does your jurisdiction provide to researchers, if any? Is it sufficient, how could it be improved ?<br>
· What obstacles are currently preventing effective safe harbours from being created?<br>
· What would an ideal safe harbour protect researchers from?<br>
· What other policy measures than legislation could governments use to create and implement safe harbours?<br>
· Should a safe harbour contain measures to discourage wrongful legal threats and pressure on vulnerability researchers, and if so through which measures?<br>
· What key principles should vulnerability researchers respect to benefit from safe harbour protection?<br>
· Do you have examples of comprehensive guidance for security researchers that could be used to support safe harbour protection?<br>
· Do you think that a “chartered profession” with specific ethical rules should/could be created for vulnerability researchers?<br>
<br>
</span></div>
<div><span style="font-size: 14px;">In addition to those questions, feel free to send me any comment you may have when thinking of safe harbours and guidance for vulnerability researchers.<br>
I am looking forward to getting your feedbacks on these challenging issues either by mail or through a video call.<br>
</span></div>
<div>
<p class="MsoNormal" style="margin: 0cm;"><span style="font-size: 14px;">Nb : Previous OECD work in this area: <o:p></o:p></span></p>
<ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm;">
<li class="MsoListParagraphCxSpFirst" style="margin: 0cm;"><span style="font-size: 14px;"><a href="https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0482" style="color: rgb(5, 99, 193);">Recommendation</a><o:p></o:p></span></li><li class="MsoListParagraphCxSpMiddle" style="margin: 0cm;"><span style="font-size: 14px;"><a href="https://web-archive.oecd.org/2021-02-10/579070-encouraging-vulnerability-treatment.pdf" style="color: rgb(5, 99, 193);">Policy note</a><o:p></o:p></span></li><li class="MsoListParagraphCxSpMiddle" style="margin: 0cm;"><span style="font-size: 14px;"><a href="https://www.oecd-ilibrary.org/science-and-technology/encouraging-vulnerability-treatment_0e2615ba-en" style="color: rgb(5, 99, 193);">Policy paper</a><o:p></o:p></span></li><li class="MsoListParagraphCxSpLast" style="margin: 0cm;"><a href="https://one.oecd.org/document/DSTI/CDEP/SDE(2020)3/FINAL/en/pdf" style="color: rgb(5, 99, 193); font-size: 14px;">Background paper</a></li></ul>
</div>
<span>_______________________________________________</span><br>
<span>oecditac mailing list</span><br>
<span>oecditac@elists.isoc.org</span><br>
<span>https://elists.isoc.org/mailman/listinfo/oecditac</span><br>
<span></span><br>
<span>View the Internet Society Code of Conduct: https://www.internetsociety.org/become-a-member/code-of-conduct/</span><br>
</div>
</blockquote>
</body>
</html>