IGF 2019 WS #406
Ethical Hacking: Risk or chance for a more secure internet?

Relevance to Theme: The security of IT systems or critical infrastructures are very important for a stable and reliable society. If those central systems are not working as intended prosperity, environments or lifes could be in danger.

The current development shows that there is a growing amount of connected devices and systems, therefore leading to a constantly expanding attack surface. Furthermore the professionality of cybercrime is constantly growing.
This means we not only need to adress the technial challenges, but also adapt an international, organisational standard for incident responses in order to ensure a secure internet.
One component could be allowing ethical hackers to conduct research and report security vulnerabilities to the providers or goverment agencies. Issues could be fixed before harm is done by a malicious attacker.
In the past there were several cases where ethical "white-hat" hacking lead to more secure IT systems and within the open-source community it is pretty common to report security risks to the maintaining party. Several government Computer Emergency Response Teams (CERTs) have implemented a vulnerability reporting process in order to protect their own systems and the ones crucial for the well-being of the society - but there is no world-wide standard or agreement how to deal with ethical hacking, so most of the time this security research is acting in a "greyfield".

Furthermore, there are regulations in a few countries, e.g. the so called "IT-Sicherheitsgesetz" in Germany, which motivates providers of "critical infrastructures" to adhere to certain IT security standards. However, this is not enought because the internet is borderless, what makes security, safety, stability and resilience a global challenge.
Current political discussions focus mostly on prohibiting hacking or hacking tools instead of using the hackers' creative work in a positive way to build a more secure ecosystem. Right now, security researchers might face legal threats or repercussions. Several such cases (in which ethical hackers were criminalized) are known in the IT security community.

A positive side effect of allowing ethical hacking could be a constant (e.g. yearly) report about handled vulnerabilities or the state of the internet security. This could strengthen the trust in new technologies of the civil society, because they know that people care and think about their privacy and data on a global and not only national level.

Relevance to Internet Governance: The regulation and acceptance of ethical hacking can help to assure the security and stability of the internet. Security is only achievable when all participants of the global, interconnected infrastructure - that we call the internet - work together. Due to it's distributed nature, it is not sufficient if only parts of the internet are secured, because they still can be attacked by unsecured and unpatched systems.
One way to assure the internet's stability is to convince policy makers that there is a need for certain standards of vulnerability reporting to facilitate reporting and addressing of potential security issues.
Hacking in general should not be condemned but be seen as an opportunity to achieve higher security standards. A specialized framework and process that different stakeholders can rely on would immensely improve the current situation. The status quo does not provide any international standards on ethical hacking or guidelines on how to handle reports from security researchers. During the recent years the privacy aspect of internet governance developed in a quite positive way. For example most of the companies have a privacy policy and point of contact for issues in that regard. Having a similar point of contact for security related issues, especially for bigger organisations, is one of the goals. Internet Governance provides a multi-stakeholder way to discuss and implement the most pressing topics around "ethical hacking".