Malware Counter-Proliferation and the Wassenaar Arrangement

Abstract

Can states control malware? It’s a radical asymmetry, the power of a modern nation-state arrayed against a few hundred thousand bytes of code and its creators, but an imbalance whose counterintuitive nature impacts the security of citizens, corporations, and governments alike. This paper evaluates export controls targeting malware, found in the Wassenaar Arrangement, in the context of research into the malicious software ecosystem. Highlighting the limitations of export controls to restrict the flow of malware, the paper offers a path forward through clarity of policy goals and enhanced incentives for vulnerability researchers.

Keywords: malware, milware, malware market, cyber crime, export controls, foreign policy, Wassenaar Arrangement