Are copyrights/copyright laws an IT Security Professional's responsibility?

Question

Let me start by saying, I am by no means trying to start a big fuss here, but I blatantly disagree with the communication I shared with AViD in this question, and I'm curious other's experience:

Copyright issues with encryption algorithms

Although stackoverflow may not be the proper place for the question, I still feel as though IT Security is not the place to ask copyright questions.

The ONLY reason this is being allowed to fly is because he is asking about copyright of encryption algorithms.

If this individual had asked if he/she could use a javascript code snippet he/she copied from the viewing source of somewebsite.com in his new app without copyright infringement it would be off topic, as it doesn't relate to IT Security, it relates to legal aspects of intellectual property, not vulnerabilities and exploitation, etc..

That said, I completely disagree with the communication AViD shared with me, as I have never and should not ever be relied upon for legal counsel as a Software Security Engineer.

Has anybody ever had experience the other way? If I am mistaken I will gladly throw in the towel, I am just looking for more community opinion here.

Again this isn't an attack on AViD by any means, it is just an attempt to get more visual on the disagreement for more open-community feedback.

Answer 1

What if the question is answered by a lawyer? :)

I suppose law and IT security have something in common: if you're given bad advice you could end up in jail! I agree that if you want legal advice you should seek legal counsel and that the heart of the question is not really an IT security question. On the other hand the answer was pretty good!

However I believe the answer to your question lies here: Area 51 - Software Law. It seems far more suited for this question (let's hope it's being set up by lawyers!).

Answer 2

I agree with Ventral that the proposed Software Law - Area 51 - Stack Exchange site would probably be the best place (if and when it gets set up) for your JavaScript example.

But the world is interconnected, not a bunch of independent content silos, and I'm not sure why we would spend a lot of effort policing corner cases. There is indeed overlap between security and a host of legal issues, and I know lots of folks with interest in both areas. As they say, Code is Law. If your site goes off the air after a DMCA take-down because it ripped of a proprietary JavaScript library, that can be seen as a DOS vulnerability just as dangerous as some kinds of software vulnerability.

So I encourage folks to feel free to answer such questions with the benefit of their security perspective, as well as providing links to alternative sources of wisdom.

Answer 3

Slight disclaimer - I'm not an IT Security person...I am an information security specialist - the difference being that copyright absolutely comes under my remit in a number of engagements. However, as a techy and not a lawyer (despite years of arranging legal terms with global orgs I definitely don't want to go down that route :-)

I find the question challenging, as in a typical organisation it will be IT who will be punished if they have been infringing copyright law in their code, so it is well worth techies knowing at least a minimum level of this kind of thing.

I know it shouldn't be like that, but IT tends to be blamed for most things :-P

In summary, there should be a place more suited to this question - yes - but I also think it is relevant here, so even if a more appropriate stackexchange site is set up I'd still like a link from this question here to it for posterity.

Just my opinion.

Answer 4

I think the question linked is relevant because it is about crypto and security. Our collective knowledge of crypto might be able to steer people around possible legal issues.

I guess if you flip it around the question is this: "Since we aren't lawyers or care to deal with law related issues, is it ok to talk about cracking/hacking computers, exchanging malware, and exchanging tips for exploiting computers and not worry about illegal activity?"

Partially a bad example because it creeps too broadly outside our mandate, but I think the point can still be made that we do decide some security issues by reflecting on the law.

Alex, I think your best point is: "Was the poster asking a (primarily) security question or a legal question?" I think the question might have been poorly asked. But sometimes we can answer what they intended to ask (or maybe we heavily edit the question). If we strictly look at what the poster asked, i can understand what you are saying.

(copyright shouldn't be the issue anyway unless they are violating the GPL or distributing someone's code or something...)

Answer 5

I agree that this is not the place for questions on copyright law, or any other kind of law, IP or otherwise.
(Umm... except for regulation/compliance-related questions, I guess... I'm sure we'll get some SOx experts eventually...)

However, out of all IT-type personnel, I believe that ITSec folk would have the best "feel" for these issues, simply from (a) experience with compliance issues, and (b) overall risk management (for those that do that) - albeit a business risk, and not a technical one. Most likely, the answer should be to point to an actual lawyer - but perhaps not always....

Like the case under discussion. Again, while I agree that questions that are net about copyrights should be offtopic, this question was more around the viable options for using cryptography.
I'd even say that the question, while a good one, was not expressed well, probably from lack of knowledge of the OP. That is to say, though the question seemed to focus on copyright, what the OP really wanted to know is "What cryptographic libraries can I use, and what restrictions are there?"
Since it's (usually) on ITSec's recommendation to use crypto, it would be legitimate to expect them to have a viable solution :)

---

Something else just occurred to me...
It is clear that this question is ontopic, I don't think anyone would object... but its about laws, right? Privacy laws. why is that okay?
Simply put, because there are laws that are in the domain of InfoSec. I don't doubt that I (or privacy expert) would be better suited to answer most practical questions around privacy, than a lawyer. (Though of course when it comes to litigation and potential repurcussions, of course a lawyers input is needed.) To some extent, this applies in other areas, too...