The Hip Hacker's Guide to Policy

A panel from the I Am The Cavalry track at BSides Las Vegas 2022 set out to explain how policy gets made, starting with a simplified tour of the three branches of the US government. The speakers described how Congress writes laws, how regulatory agencies create rules through public comment, and why executive orders depend on existing statutory authority. They argued that influence is possible at several points in this cycle, including committee staff, rulemaking comments, and coordinated letters that gain weight when many organizations sign on.

The middle of the session covered legal protections for security research. The panel traced how the DMCA exemption for research was created and renewed through the Library of Congress process, and how the Department of Justice later issued guidance telling federal prosecutors to decline good-faith research cases under the computer fraud statute. They also discussed vulnerability disclosure policies as a practical way for organizations to authorize testing, and noted that state laws differ. The IoT Cybersecurity Improvement Act and newer federal reporting and zero trust efforts were presented as signs of a growing government appetite for cybersecurity regulation.

The takeaway for practitioners is that framing matters. Legal arguments focus on conduct and research outcomes rather than on whether someone calls themselves a researcher. Specific, technical comments on draft language are more useful to policymakers than general opposition, and state-level developments are worth sharing through community channels. The panel acknowledged that defining good faith remains hard and encouraged the community to help articulate norms for responsible research.