4

Much of our critical infrastructure relies on encryption as the bedrock of its security. Encryption, however, is a practically a "very hard" mathematical problem that will take eternity to solve with current technology.

Let us say someone using the Ballmer's peak to their advantage (lol) develops an algorithm that allows us to solve that incredibly hard math problem in minutes. Is it legal for them to open-source this algorithm and also publicize about how it can help break encryption (they never talk about stealing)?

I get that someone using the algorithm to break into someone else's system is a crime, same as robbing something from a house for which you can now make the keys. But open-sourcing such a critical solution will empower bad actors and nation states to hack other's systems regardless.

Is our boy-genius developer legally (not ethically) obligated to do anything if they make such a discovery?

Improve this question
5
  • 1
    Which jurisdiction? Different countries have very different rules on disseminating “hacker tools”, though there is some harmonization via the Wassenaar Arrangement. At least in the western world, it would definitely be OK to publish the research on the math problem though. For example, a proof that prime factorization is possible in polynomial time would be most interesting to the math community, aside from implying that RSA encryption is broken.
    – amon
    Oct 26, 2021 at 14:02
  • law.stackexchange.com/questions/53675/…
    – BlueDogRanch
    Oct 26, 2021 at 14:04
  • @amon yeah, I was referring western world. The question arises because of the nature of the discovery. It can lead to a nuclear security crises, wars, bankruptcies, and even more.
    – Ugam Kamat
    Oct 26, 2021 at 16:01
  • "Western world" still includes dozens of countries and thus dozens of completely different legal systems. Please be more specific - ideally, one single country.
    – Nate Eldredge
    Oct 26, 2021 at 17:27
  • @NateEldredge If I were to pick one, it would be US
    – Ugam Kamat
    Oct 26, 2021 at 18:24

1 Answer 1

Reset to default
4

There are two processes that go on all the time, and are generally considered legal:

  1. Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The history of SHA-1 is a good example of this.

  2. People identify security holes in software and follow responsible disclosure rules. This means that they notify the vendor and give them an opportunity to fix the bug before going public. Note that this is merely considered good practice; immediate publication would be legal too.

Your scenario sits at the intersection of these two processes: an attack (process 1) which completely destroys the security of many systems (process 2).

Responsible disclosure occupies a legal grey area: someone who finds a bug might have had to exploit it to at least some degree to demonstrate it, and there have been cases where vendors have used police or courts to retaliate. However this wouldn't apply to your scenario.

In America the First Amendment makes it unconstitutional to use the legal system to stop people saying true things (copyright excepted, and untrue things are often legal too). If your Wunderkind lives in America then a widely published factual description of their solution would therefore be legal. Legal problems only start if they provide the details in secret to people they should reasonably suspect of intending to use them for crime.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .