Slashdot Log In
UK Moves to Outlaw 'Hacker Tools'
Journal written by twitter (104583) and posted by
Zonk
on Thu Jan 03, 2008 04:21 PM
from the getting-to-be-popular-over-there dept.
from the getting-to-be-popular-over-there dept.
twitter writes "New guidance rules for the UK's controversial Computer Misuse Act do not allay fears of impracticality, or of the banning of legitimate IT software: 'The government has come through with guidelines that address some, but not all, of these concerns about dual-use tools. The guidelines establish that to successfully prosecute the author of a tool it needs to be shown that they intended it to be used to commit computer crime. But the Home Office, despite lobbying, refused to withdraw the distribution offense. This leaves the door open to prosecute people who distribute a tool, such as nmap, that's subsequently abused by hackers.'" Somewhat similar legislation recently became law in Germany.
Related Stories
[+]
IT: Strict German Computer Crime Law Now in Effect 226 comments
SkiifGeek writes "With little fanfare, section 202c of the German computer crime laws came into effect over the weekend. Worryingly for Security professionals, the laws make the mere possession of (creates, obtains or provides access to, sells, yields, distributes or otherwise allows access to) many useful tools illegal. A similar law was proposed for the UK, however it was modified prior to passing through parliament due to the outcry from the industry. Phenoelit, KisMAC, the CCC, and the Month of PHP Bugs are just some of the relatively high profile projects and groups to have already taken measures to remove or modify content under this law."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I better take down... (Score:4, Funny)
Re:I better take down... (Score:4, Funny)
Parent
IDEs too? (Score:3, Insightful)
These laws are just retarded knee jerk reactions made by people who have no idea about what it is they are legislating on.
-Rick
Re: (Score:3, Interesting)
I wonder if we showed the stupid leaders in parliament, this fact, then would they ban microsoft all together for creating such devious tools....
Re:IDEs too? (Score:5, Insightful)
No, not a chance. What they really mean is if you wear tee shirt and create a dual-use tool in your basement, is contraband. But the same tool created by a person wearing a suit and tie in a corporation then it's okay.
Parent
Re: (Score:3, Informative)
Re:IDEs too? Oh yes, and what about OO Design? (Score:5, Insightful)
When they got scared.
The real truth is that there is no bogeyman, and that there's nothing to fear but fear itself. Even my four-year old knows that. ("[Girl Name], what do we have to be afraid of?" "Being afraid.")
And now, some "crimes" are nearly impossible to prosecute. How can someone in the UK file suit against a "cracker" from Atiqua or Afghanistan? They could potentially steal your bank account information and steal your life savings, buy a handgun, rob a bank, and put you on death row. Now, when you assume - note that word - that the backwards savages outside your home country have to have help to break in, then clearly someone with brains - I mean a white guy - er, I mean someone from the homeland - er, someone reachable by our police - must have helped them. That's complete junk, but to some the point is valid. The bad guys must have help, so let's go after the help. Never mind that the "bad guys" get paid more than I do.
And people are scared because they think things are the worst they've ever been. The fact is, the good old days were never here. Terrorists have been around since at least the Romans. We survive. The day of judgment will never come.
But that's not enough. You can't tell people to calm down - you have to show them that you're doing something, anything.
Seriously - people are attempting to legislate abstract concepts that they don't know about. I've seen laws suggesting watermarks in A/D conveters. One of the US Senators honestly thinks the Interweb is a series of tubes. He might not even be familiar with the concept of electricity. Imagine Ancient Greeks trying to pass legislation on the use of titanium in groundwater near nuclear power plants. If I give an opinion on civil engineering, I could be fined up to $25,000. If a politician does, he gets rewarded.
Instead of demanding the removal of the clueless, people just revote for the same guy as last time - if they even voted - or "stay the course". When those in charge have literally no consequences for their actions and get paid to pass legislation from special interest groups. Is copyright theft something that ordinary people really care about? Are there people who are thinking, "man, I'd love to go to work today, but I'm afraid that someone, somewhere, is copying a DVD to take the ads out. If only our government would pass some laws to fix that problem." Okay, maybe if the guy works making DVDs, but that's not a normal guy.
When the victims became criminals. Look at identity theft - it could be prevented with 100% accuracy if the credit bureaus updated their computers. All they have to do is add a picture to your report and require an automatic phone call to the last known phone number any time you want a change. That's it. It's now impossible to steal someone's ID. Of course, it's your fault for not buying title insurance, paying Equifax $25 a month for credit checks, and using your "internet thing" for banking.
When people started getting used to the idea of "I have nothing to hide". You do. Everyone does. I have skeletons in my closet, and I want them to stay there.
So what it really boils down to is that people are in general afraid of something, but they don't know what it is. So, they turn their wrath on anything that can possibly hold their ire. Immigrants, Hackers, ID thieves, the Russians, terrorists, etc. As long as the eye isn't on them, then they're fine. Torture the sandnigger or the hacker. They're the ones who made the world such a fucked up place. It's all their fault.
They're really afraid of themselves. How long will it be until the bank comes calling, or the boss cans them, or the spouse will leave with the kids?
It's a scary thought - we're lead by clueless, corrupt, whores who run the place by tacit consent from people who are too afraid to interrupt their routine.
This isn't exactly what I meant to say, but I think the power here has become unreliable. There's a lot of wind outside.
Parent
Re:IDEs too? Oh yes, and what about OO Design? (Score:4, Insightful)
"One of the US Senators honestly thinks the Interweb is a series of tubes. He might not even be familiar with the concept of electricity."
No, one of our Senators used a clumsy analogy. None of them really think the net is composed of tubes. Yes, they are legislating issues they don't understand... but they aren't retarded. I'm quite sure the majority of congressmen have above average IQs. They may be corrupted or arrogant, ignorant of tech issues, but not stupid.
I'm not really arguing with you, I just think you're passionate and letting some of your rhetoric get a little carried away. Take your own advice: "We survive. The day of judgment will never come."
"This isn't exactly what I meant to say, but I think the power here has become unreliable. There's a lot of wind outside."
I spent a moment trying to figure out what your metaphor meant... is "Wind" our political climate? Then I realized you're literally talking about 'power' and 'wind.'
Parent
Re:IDEs too? Oh yes, and what about OO Design? (Score:4, Interesting)
I'm not sure most people honestly think they have nothing to hide. They've been trained, however, to think that failure to act like one has nothing to hide will reveal what they have to hide.
I think it's likely a result of a culture obsessed with cop fantasy shows in which the cops can do pretty much anything they want to solve the crime, justified by depictions of the people the fantasy cops zero in on as nearly always guilty.
Parent
Re:IDEs too? Oh yes, and what about OO Design? (Score:4, Insightful)
When you build your code by hiring the lowest bidder with the least qualifications, then you should be liable. If a bridge building contractor didn't keep blueprints and didn't hire a qualified crew, then they would be sued or imprisoned. I can't just go and build a stadium or an overpass just because I think there should be one there.
If you do that with software - even software potentially worth billions of dollars - you get more contracts. Of course, it's not like anyone died as a result of bad software... oh, right. Any idiot can grab a book on teaching yourself programming and think they're an expert in 24 hours.
I have the knowledge to visit your reservoir and shut it down. (I'd have to actually visit it in person, but it's not like it's under guard.) That's just damned irresponsible programming on the part of the SCADA guys. Oops, your fecal chloroform count is way too high. Passport applications in Canada were compromised by bad coding, and last year the Canadian tax system shut down due to a glitch.
It is damned irresponsible to punish someone for making an nmap program publicly available when the institutions don't put on basic security measures. The cops say it's my fault if I don't lock my car. Why is this any different?
Parent
Re:IDEs too? Oh yes, and what about OO Design? (Score:4, Interesting)
Or maybe your logic just isn't.
Parent
Re:IDEs too? Oh yes, and what about OO Design? (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Re:IDEs too? (Score:4, Insightful)
When guns are outlawed, only outlaws will have guns.
Parent
Still available for legitimate use? (Score:3, Interesting)
Re:IDEs too? (Score:4, Informative)
Parent
Time to flee the Fascist State of America... (Score:5, Funny)
Re: (Score:3, Insightful)
Re:Time to flee the Fascist State of America... (Score:4, Funny)
Parent
Idiots... (Score:4, Insightful)
Re: (Score:3, Insightful)
Oh, the ironing.
Re:Idiots... (Score:4, Insightful)
If the UK's system is anything like Australia's (and it is) then health care proffessionals "control the industry". Over the past 3 decades those politicians who have tried to dismantle our universal system and hand it back to corporate interests have felt the wrath of the 80+% of voters who like it the way it is.
The problem with the US is that despite decades of experience and a mountain of evidence to the contrary, a lot of people still hold a deep-seated belief that UHC is a socialist plot to take over their wallet.
Parent
Re:Idiots... (Score:5, Insightful)
Well that's the problem, politicians have to make choices on topics they don't understand all the time. Do you think they really understand economic theory well enough to pass many of the laws they do? Do they understand health care? Do they understand military strategy? Hardly. Sure they listen to "advisers" but basically you'll always find people arguing about if things will really work or not. This is magnified many times over in the U.S. where we only have two parties.
The best you can hope for is people yelling loud enough to stop government stupidity from passing things like "anti hacker tools" type laws. Unfortunately there's always SOMEONE yelling trying to stop everything which is part of the reasons governments do so little.
Parent
IRC and Windows (Score:5, Funny)
Re:IRC and Windows (Score:5, Funny)
Parent
For once, I can feel good as an American (Score:4, Insightful)
Not surprised (Score:4, Funny)
It's not about security. (Score:5, Insightful)
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
Instead they just criminalise the capability to commit a crime. No matter whether there may be a legitimate use for something, or whether there may be enthusiasts who take pleasure from understanding how security works. Of course, they're not going to actually prosecute people who they think probably aren't going to commit a real crime. Just those
seriously (Score:4, Funny)
Yes, ladies and gents, that was sarcasm.
Outlaw politicans who make stupid laws about tech (Score:4, Interesting)
Whilst the law was going through Parliament the Home Office suggested that "likely" would be a 50% test.. Anyway, that guidance is now out -- and there's no mention, surprise, surprise, of "50%"
If over 50% of the laws they make are nonsense, can we ban the politicians?
Reminds me of the middle ages (Score:4, Interesting)
Hopefully this mistake won't take 400 year to remedy.
Re: (Score:3, Insightful)
And, sure enough, it wasn't long after affordable printing and widespread literacy that Roman Catholicism headed steeply into its ongoing decline. (No, I'm not saying the enlightenment was a bad thing, just that it's exactly what the Church feare
Just for the sake of argument- (Score:5, Interesting)
Yes, this would mean our having to get certified as at least minimally competent at what we do, much like hairdressers and engineers.
The idea is analogous to how, in New York at least, it's illegal for random people to carry lockpicks.
Re: (Score:3, Insightful)
Re:Just for the sake of argument- (Score:4, Insightful)
In both those cases, the requirements are based on the assumption that there is a risk to the customers, that customers cannot readily evaluate. (The free market can't solve problems, like safety in some cases, that are very difficult for consumers to evaluate.)
I'm firmly against the idea of making ownership of lockpicks illegal, for the same reason as I'm against this law. As I understand the law here in North Carolina about lockpicks, I rather like it. You're allowed to own them, but if you're breaking and entering, tresspassing, or doing something similar, and carrying lockpicks then they automatically count as burglary tools. I rather like this policy -- it adds harsher penalties for those who go about acquiring tools and skills for illegitimate purposes, yet allows people like myself to own lockpicks purely because we like understanding how locks work. The analogy to computer security tools is a very good one, I think.
Requiring certification of people representing themselves as computer security experts might make sense (I'd withold judgement until I knew more about how it worked, personally). But restricting the tools doesn't. Adding something analogous to possession of burglary tools, though, does make sense to me. (Well, somewhat -- it's complicated, and since you can't really break into a computer without some level of software tool, the analogy gets strained.)
Parent
Please don't use my state as a paragon of freedom (Score:4, Insightful)
Certifications don't protect the public. They protect the certified against competition.
Parent
The Idiots are at it again... (Score:5, Insightful)
Well, they may as well outlaw all of software development, because any software tool can be put to malicious purposes.
What they should focus on instead are the actual actions taken by individuals to compromise someone's computer or network, not the tools they use to do it with. For instance, there's already a number of tools on the market and in FOSS that can do DDoS attacks -- but they are normally used to stress-test a web site or some other network application.
The whole "intent" bit is always a slippery slope, ready for Kangaroo Court time. Obviously, these idiot politicians never saw or read "Minority Report", where going after "pre-crime" turnned out to cause more problems than it solved.
Yes, the governments of the world are not unlike a bunch of monkeys with dangerous toys -- total unbridled power, without the wisdom nor the precision to use it properly.
What about..... (Score:3, Insightful)
The solution: ban brains.
Outside the sarcasm tags, I wonder how long it will be before some moron tries that.
'Legitimate' tools? (Score:5, Insightful)
Re:'Legitimate' tools? (Score:4, Insightful)
I see no reason to go down this track at all.
Parent
Great Idea! (Score:5, Insightful)
Then we can just arrest everybody who has them, and we'll have our systems broken into by the black hats we missed, while those who would have protected us have their hands tied.
And that's while using the popular meaning of "hacker", rather than the correct one.
Quick! Outlaw Pencils and Paperclips! (Score:3, Interesting)
Thought Tools (Score:5, Interesting)
WIth 'bad' being relative to the administration in charge at the time in said country.
Will they be outlawing FTP or HTTP as well?
Guidance text- rigged against free/open source (Score:3, Informative)
CMA = Computer Misuse Act
The whole thing seems to be rigged against free software/open source and heavily in favour of security through obscurity. Perhaps we should contact them and ask?
Everything below is copied from the guidance.
Prosecutors should be aware that there is a legitimate industry concerned with the security of computer systems that generates 'articles' (this includes any program or data held in electronic form) to test and/or audit hardware and software. Some articles will therefore have a dual use and prosecutors need to ascertain that the suspect has a criminal intent.
Whilst the facts of each case will be different, the elements to prove the offence will be the same. Prosecutors dealing with dual use articles should consider the following factors in deciding whether to prosecute:
* Does the institution, company or other body have in place robust and up to date contracts, terms and conditions or acceptable use polices?
* Are students, customers and others made aware of the CMA and what is lawful and unlawful?
* Do students, customers or others have to sign a declaration that they do not intend to contravene the CMA?
Section 3A (2) CMA covers the supplying or offering to supply an article "likely" to be used to commit, or assist in the commission of an offence contrary to section 1 or 3 CMA. "Likely" is not defined in CMA but, in construing what is "likely", prosecutors should look at the functionality of the article and at what, if any, thought the suspect gave to who would use it; whether for example the article was circulated to a closed and vetted list of IT security professionals or was posted openly.
In determining the likelihood of an article being used (or misused) to commit a criminal
offence, prosecutors should consider the following:
* Has the article been developed primarily, deliberately and for the sole purpose of committing a CMA offence (i.e. unauthorised access to computer material)?
* Is the article widely used for legitimate purposes?
* Is the article available on a wide scale commercial basis and sold through legitimate channels?
* Does it have a substantial installation base?
* What was the context in which the article was used to commit the offence compared with its original intended purpose?
Historical Precedent (Score:5, Insightful)
They can have my ping client .... (Score:5, Insightful)
IN SOVIET RUSSIA (Score:5, Insightful)
That just doesn't seem funny any more... :-(
Seriously, though, we're seeing a lot of this: the notion that any funny stuff, be it computer software, electronic goodies, chemistry, what have you, is a priori for bad purposes. Somehow due process has gotten lost in the shuffle, the user is apparently guilty until proven innocent, and must be dealt with accordingly.
Tragic.
...laura
Re:I cant believe this word "hacker" is misused he (Score:5, Insightful)
Get over the semantic drift already, we're not all mired in some rose-spectacled view of the technoutopia where you have to have hacked solenoids under a model railway at MIT in order to qualify for the term.
Parent