Balancing Academic Freedom and Responsibility in Security Research

The computer security community—researchers and vendors—seemingly have all agreed on a common standard of responsible disclosure. Researchers are expected to give vendors a suitable advance start to address inadequacies, and vendors are expected to actually fix their inadequacies, knowing that public disclosure is coming. Unfortunately, when security vulnerabilities impact companies from outside our immediate community, ranging from the music industry through voting system vendors to RFID cards, the shared standard of responsible disclosure seemingly falls apart. We'll review some of the history of how we got here and where we're going. Should the security community—and the computing community at large—back down when faced with legal threats to the disclosure of our research? If not, how should we fight back? How do we balance academic integrity, sharing knowledge for the greater good, and the law?