Malware counter-proliferation and the Wassenaar Arrangement

Can states control malware? It is a radical asymmetry: the power of a modern nation-state arrayed against a few hundred thousand bytes of code and its creators, but an imbalance whose counterintuitive nature impacts the security of citizens, corporations, and governments alike. This paper evaluates export controls found in the Wassenaar Arrangement targeting malware in the context of the research into the malicious software ecosystem. The article highlights that export controls place burdensome restrictions on research and commercial information security efforts. Looking at the market for malicious software, incentivising the discovery of new vulnerabilities to reduce their availability to attackers would be more effective in curtailing malicious activity.