Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard-cite-them-right
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Anticipatory Ethics for Vulnerability Disclosure
Swedish Defence University, Department of Military Studies, Science of Command and Control and Military Technology Division, Military Technology Systems Section.ORCID iD: 0000-0002-7552-9465
Towson University; Hoffberger Center for Professional Ethics, University of Baltimore.
2020 (English)In: Proceedings of the 15th International Conference on Cyber Warfare and Security / [ed] Prof. Brian K. Payne and Prof. Hongyi Wu, 2020, p. 254-261Conference paper, Published paper (Refereed)
Abstract [en]

This article presents the ethical dilemma related to under what circumstances vulnerabilities should be disclosed. Vulnerabilities exist in hardware and software, and can be as a consequence of programming errors or design flaws. Threat actors can exploit these vulnerabilities to gain otherwise unintended access to information systems, resources and/or stored information. In other words, they can be used to impact the confidentiality, integrity and availability of information in information systems. As a result, various types of vulnerabilities are highly sought after since they enable this type of access. The most highly sought are so-called “zero-day”-vulnerabilities. These are vulnerabilities that exist but are unknown, and when exploited, enable one way of entry into a system that is not thought possible. This is also why zero-day vulnerabilities are very popular among criminal organizations, states and state-sponsored advanced persistent threats. The other side of the coin is when a state identifies a zero-day, and ends up in the ethical dilemma of whether to release the news and inform the vendor to patch it, i.e. close the vulnerability, or to use it for offensive or intelligence purposes. This article employs these distinctions to apply anticipatory ethics in the Stuxnet-case. Stuxnet was a computer software that was allegedly developed by the U.S. together with Israel to disrupt Iran’s development of uranium for their nuclear program. More exactly, it was developed to disable the uranium centrifuges used to enrich uranium. To achieve this, Stuxnet exploited four zero-day vulnerabilities and, according to some experts, managed to delay Iran’s nuclear program by one to two-years, forcing them to the negotiation table. Using vulnerabilities like zero-days presents opportunities but also risks. The results of the application of anticipatory ethics to the Stuxnet case are then compared with the “Osirak”-case and the “al-Kibar”-case. Osirak was the nuclear reactor in Iraq and was bombed in 1981; al-Kibar was the nuclear reactor being built up in Syria, also bombed in 2007.

Place, publisher, year, edition, pages
2020. p. 254-261
Keywords [en]
Vulnerabilities, Zero-Days, Information Systems, Ethical Dilemma, Stuxnet, Iran Nuclear Program, Anticipatory Ethics
National Category
Social Sciences Interdisciplinary Information Systems Political Science (excluding Public Administration Studies and Globalisation Studies)
Identifiers
URN: urn:nbn:se:fhs:diva-9099DOI: 10.34190/ICCWS.20.053OAI: oai:DiVA.org:fhs-9099DiVA, id: diva2:1415413
Conference
International Conference on Cyber Warfare and Security
Available from: 2020-03-18 Created: 2020-03-18 Last updated: 2020-03-18

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full text

Search in DiVA

By author/editor
Huskaj, Gazmend
By organisation
Military Technology Systems Section
Social Sciences InterdisciplinaryInformation SystemsPolitical Science (excluding Public Administration Studies and Globalisation Studies)

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 23 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard-cite-them-right
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf