CERT looks to cash in on security data

CERT, which is federally funded and operates under the aegis of the Software Engineering Institute (SEI) at Carnegie-Mellon, has advised the public on everything from Internet virus outbreaks to denial-of-service attacks and software vulnerabilities.

When it identified a problem, CERT shared the information with the Department of Defense and posted its famous "CERT advisories" on the Web. If a product was involved, CERT gave the vendor 45 days to fix it before announcing the vulnerability to the world.

But now CERT plans to sell this sensitive information to those willing to pay big bucks (and be sworn to secrecy). To get this info, you have to pay $2,500 to $70,000 to join the Internet Security Alliance (ISA), a group just formed by CERT, SEI and the Electronic Industries Alliance trade association. Nasdaq and the Mellon Financial Group are said to be among the founding ISA members.

Why should we taxpayers pony up $3.5 million -- which is what we gave CERT last year via the Defense Information Systems Agency and General Services Administration -- if CERT is now selling information?

CERT Coordination Center team leader Shawn Hernan says CERT's employees already do paid work for corporations and this simply represents a broadening of those activities.

Of course CERT has every right to try to get the earliest drop on security bugs and sell them. But the question is, should taxpayers subsidize this? Why not have the federal agencies that need the data join as ISA members instead of the government funding CERT?

Hernan says, "CERT is going to be able to do a lot more than it has in the past with this funding. We're not trying to double-dip the federal government."

CERT's not a crook. In fact, the American public owes CERT a debt of gratitude for its work over the years. But the old CERT is gone. The Internet, too, was once subsidized by the federal government until it became apparent the world would pay for IP services. That day may be approaching for CERT, too.