GitHub joins amicus brief warning of systemic risk from private sector offensive actors
Today, GitHub joined an amicus brief in NSO v. WhatsApp, opposing the expansion of foreign sovereign immunity to private cyber-surveillance companies that act on behalf of foreign governments. GitHub joined…
Today, GitHub joined an amicus brief in NSO v. WhatsApp, opposing the expansion of foreign sovereign immunity to private cyber-surveillance companies that act on behalf of foreign governments. GitHub joined alongside Cisco, Google, LinkedIn, Microsoft, VMware, and the Internet Association against immunity for private sector offensive actors (PSOAs). Law and policy shape the software ecosystem. A policy of immunity would increase systemic risk to the ecosystem by fostering the cyber-surveillance tools market and expanding the use of such tools by governments, including in attacks on individuals and infrastructure.
At GitHub we are committed to building the global platform for developer collaboration—one that everyone can use to secure the world’s software, together. GitHub helps developers stay ahead of security issues, leverage the community’s security expertise, and use open source securely. GitHub stands against hoarding and selling exploits and attack or surveillance tools. Such tools could be used not only to infiltrate GitHub, but the millions of developers and open source projects which rely on our platform, and the software supply chain which depends on them.
We call on governments to help developers decrease systemic risk, including:
- Adopting the best tools and practices for secure software development
- Helping fund open source security projects
- Adhering to principles that increase trust and security in cyberspace
- Protecting legitimate security researchers
Immunity for cyber-surveillance companies that turn best practices on their heads, hoarding vulnerabilities to use in attacks rather than collaborating with upstream to fix, would be a step in the wrong direction.
Written by
Related posts
How researchers are using GitHub Innovation Graph data to estimate the impact of ChatGPT
An interview with economic researchers who are applying causal inference techniques to analyze the effect of generative AI tools on software development activity.
GitHub Availability Report: June 2024
In June, we experienced two incidents that resulted in degraded performance across GitHub services.
Advancing responsible practices for open source AI
Outcomes from the Partnership on AI and GitHub workshop.