Forgot your password?
typodupeerror
Privacy Your Rights Online

European Police Plan to Remote-Search Hard Drives 260

Posted by timothy
from the oh-you-needn't-come-into-the-office dept.
Smivs points out a blandly-worded story from the BBC with scary implications, excerpting "Remote searches of suspect computers will form part of an EU plan to tackle hi-tech crime. The five-year action plan will take steps to combat the growth in cyber theft and the machines used to spread spam and other malicious programs. It will also encourage better sharing of data among European police forces to track down and prosecute criminals. Europol will co-ordinate the investigative work and also issue alerts about cyber crime sprees."
This discussion has been archived. No new comments can be posted.

European Police Plan to Remote-Search Hard Drives

Comments Filter:
  • lol (Score:5, Funny)

    by snarfies (115214) on Tuesday December 02, 2008 @01:00PM (#25961423) Homepage

    Wow, good thing I have a firewall, built right into my router.

    • Re:lol (Score:5, Insightful)

      by clam666 (1178429) on Tuesday December 02, 2008 @01:19PM (#25961815)

      That's funny. I tend to keep my highly illegal terrorism-and-kiddie-porn related files on disconnected usb drives.

    • by Xest (935314) on Tuesday December 02, 2008 @02:21PM (#25962837)

      The summary takes the decision somewhat out of context.

      They're not planning to remotely connect to any old joes computer they can and search it, they're planning to connect to zombie computers that have been hijacked by criminals to try and trace back where the criminals are coming from.

      Apparently, there will be strict rules on what they can do on said machine too, that is, they're not allowed to start rummaging through people's personal data. Don't think I'm naive by saying that- I'm just repeating what I read on the issue, I don't believe for a minute those rules will be enforceable and I truly think as soon as they have access to these machines and their boss aint looking they're going to start rummaging like crazy.

      I'm not sure how I feel about the general idea, if a machine has a backdoor and they can manage to connect to it also then in a way I feel they should just temporarily patch it for the user and inform the user at absolute worse although I'm not sure this is ideal- what if they patch some security researcher's honey pot for instance!

      It certainly concerned me a bit when I read it but it's certainly not a plan to just use 0-day exploits to connect to everyone and anyone's PC or anything.

      • Re: (Score:3, Insightful)

        by Rary (566291)

        I don't believe for a minute those rules will be enforceable and I truly think as soon as they have access to these machines and their boss aint looking they're going to start rummaging like crazy.

        Right. Because police tracking down criminal networks are more than willing to risk their careers to sneak a peak at some random person's emails to their grandmother, pictures of their friends, and last year's Christmas wish list.

        I'm not saying that nobody will ever overstep their snooping mandate, but I think we can all loosen the tinfoil hats just a bit. If your computer is one of these zombies, I'd be more concerned about the snooping that may have been done by the people who zombified it in the first pl

        • by cicho (45472) on Tuesday December 02, 2008 @03:54PM (#25964479) Homepage

          You are wrong. First, because yes, people will risk their careers to snoop on the privacy of total strangers, just because they can. Since they work in secrecy, it's even debatable if they feel their careers at at risk for doing so: http://abcnews.go.com/print?id=5987804 [go.com]

          Second, because as alarming as the linked story is, privacy is ultimately not about the police reading your shopping list. It's always about money - the money someone is willing to pay to access personal data on a political opponent (to discredit her or him), a dissident group (to penetrate and spy on them), or a competing business (obvious).

          Therefore, it's also about human rights.

          Once the technology is available, it *will* be abused, and we know this, because such abuses have always happened. I don't know of a government (or a business) that had a technology available and decided not to use it because doing so would be unethical or even illegal. How many times must the same stories repeat before we learn?

          • by Stanislav_J (947290) on Tuesday December 02, 2008 @05:54PM (#25966659)

            Once the technology is available, it *will* be abused, and we know this, because such abuses have always happened. I don't know of a government (or a business) that had a technology available and decided not to use it because doing so would be unethical or even illegal. How many times must the same stories repeat before we learn?

            An old saying puts it best: "What the government wants to do, and has the means to do, it will do -- logic, ethics, and common sense notwithstanding."

      • Re: (Score:3, Informative)

        by KlausBreuer (105581)

        Sadly, this is not quite correct.

        Here in Germany, they plan (and already have) to simply control you. Are you an eeeeeevil terrarist? Do you think of possibly considering, at some time in the far future, if you might want to do something which might bother some state bureaucrats? Do you Obey The RIAA?

        It's not about spam, and zombie computers, and stuff like that. It's about control.

        And, by the way, they are allowed to secretly enter your home, install some crap on your PC, and leave again. The might need a

  • by VShael (62735) on Tuesday December 02, 2008 @01:02PM (#25961481) Journal

    In a statement outlining the strategy the EU claimed "half of all internet crime involves the production, distribution and sale of child pornography".

    And the other half is copyright infringement?

    • by sakdoctor (1087155) on Tuesday December 02, 2008 @01:11PM (#25961641) Homepage

      I get MY statistics from /dev/random
      Oh look, IE usage has dropped to less than 1% and the US is no longer in debt.

    • by Kjella (173770)

      Well, if you want to get pendantic then maybe they don't count criminal copyright infringement. While a civil suit can cost you a lot of money and can be very serious in itself, it doesn't leave you a criminal record. Or maybe they counted reported crime figures, you can be fairly sure kiddie porn is reported but you could report thepiratebay.org torrents all day long and noone would care. In other words, there's a million ways to cheat with statistics without making things up. There's a reason they say whi

      • Re: (Score:3, Insightful)

        by Reziac (43301) *

        Here's a dumb but not entirely theoretical question: how do you count copyright infringement of kiddie porn images??

        After all, doesn't the porn industry claim it's the most infringed of all copyrighted material??

    • Re: (Score:3, Insightful)

      by russotto (537200)

      And the other half is copyright infringement?

      Leaving the 419 scams, eBay fraud, phishing for financial details, and violating the MySpace TOS all lost in the noise.

    • Re: (Score:3, Funny)

      No, the other half is people making bad youtube videos with bad acting, tone-deaf singing and faked nutshot accidents.
  • by zappepcs (820751) on Tuesday December 02, 2008 @01:03PM (#25961505) Journal

    Can you repeat after me?

    When this is implemented, it will be....

    duh du duhnnn

    Wait for it.....

    "The year of Linux on the desktop"!

  • you frequently here discussions on slashdot about grey hat activities: going to computers hosting worms, and shutting down the worm remotely, for example. and you hear many people here supporting that

    now in europe, this is exactly what they are going to do: shut down zombies, shut down spam relays, and everyone on slashdot babbles incoherently about teh ev1l gubmint invading our computers. when such european effort sprobably sprang directly from the kind of strategizing peopl ehere on slashdot frequnetly en

    • I want the same rights the police have. I want to be remote searching their hard drives, and the hard drives of corporate executives, and of politicians. I have no more reason to trust them than they have to trust me, and neither do any of you. We should all have the right to know what is going on. If we don't, corruption is a systemic inevitability. Which should be abundantly obvious to anyone who has been paying attention to the events of the last few years.

      • by Reziac (43301) *

        I also want access to every tool that the police and other gov't agencies have access to, from weapons to forensics.

        Without this parity, We The People are at their mercy.

      • If we don't, corruption is a systemic inevitability. Which should be abundantly obvious to anyone who has been paying attention to the events of humanity.

        Fixed that for you.

    • by ODiV (51631) on Tuesday December 02, 2008 @01:38PM (#25962127)

      now in europe, this is exactly what they are going to do: shut down zombies, shut down spam relays, and everyone on slashdot babbles incoherently about teh ev1l gubmint invading our computers.

      You've got the eighth comment! And judging by the length of your comment you probably didn't even see half of the previous ones before you posted.

      if you instead spastically flail out everytime someone words an article in a propagandistic manner

      Oh hi.

    • by k1e0x (1040314)

      do you care about rights and freedoms?

      you do?

      then react to REAL and GENUINE threats to them

      if you instead spastically flail out everytime someone words an article in a propagandistic manner, you are no defender of rights and freedoms, you are merely a manipulated hysterical fool. and, in fact, someone useful for the suppression of our rights, by proving to those who wish to restrict our rights that people don't even understand what their rights are

      defend your rights and freedoms

      against genuine threats

      The government is the only entity that can actually take your rights away. The reason this is so is because they are the only entity that can legitimately use force on you.

      Well technically, nobody can *take* a right because nobody can *grants* a right, rights are unalienable, and they can never be legitimate to infringe upon someones rights no matter if they are the government or not. However if you try to say "No" to the government, you will find yourself in a jail cell. If you continue to try say "No" to

  • by Thelasko (1196535) on Tuesday December 02, 2008 @01:06PM (#25961539) Journal
    What it sounds like to me is that police departments will be able to search other police departments' computers. Not police searching civilian computers. The whole article is vague by using the term "remote searches" and not giving any more explanation.
  • how how how? (Score:2, Insightful)

    by Bizzeh (851225)

    how would this work? since to access my hard drive to search it, they would need.

    1. me to be on the internet at the time they want to search my drive.
    2. my to give them access to my machine via a remote desktop style connection, which would involve me giving them a username and password to my machine.

    or

    1. me to be on the internet at some point
    2. mandating that EVERYONE in the EU runs an application that indexes the entire of all the hard drives connected to a machine, and transmits the index to a central lo

    • Re:how how how? (Score:4, Interesting)

      by TripMaster Monkey (862126) on Tuesday December 02, 2008 @01:12PM (#25961649)

      how would this work?

      Please see my earlier post [slashdot.org] regarding this...apparently, they plan to infect your system with a remote access Trojan.

      But don't worry...it's for your own good.

      • Re: (Score:2, Funny)

        by Anonymous Coward

        ...apparently, they plan to infect your system with a remote access Trojan. But don't worry...it's for your own good.

        Oh! That feels so much better with a Trojan. Should we all oil our hard drives beforehand to increase the pleasure?

    • or... (Score:3, Insightful)

      by pointbeing (701902)

      or

      1. search your computer through backdoor built into closed-source operating system.

      • by meist3r (1061628)

        or

        1. search your computer through backdoor built into closed-source operating system.

        or

        1. search your computer through a backdoor injected in one of your repository package upgrades built into the conveniently open-source operating system.

        I'm a Linux user and fan myself but in this case it would be even easier for governments to secretly slip someone a manipulated file.

  • Wow! (Score:5, Insightful)

    by gstoddart (321705) on Tuesday December 02, 2008 @01:07PM (#25961569) Homepage

    You know, it's awfully hard to not be yet again reminded of Orwell here. Constant surveillance and no privacy from the government so they can monitor everything you do.

    But, of course, if your machine is behind a firewall, they'll just outlaw having firewall because it impedes their ability to investigate you for crimes. At which point if you need to be insecure enough to ensure that law enforcement can get in and do this, your machine will be hosed within the hour as the actual bad people break through as well.

    This will either fall apart as un-doable, or spark some absurd laws to enforce it.

    Cheers

    • Unfortunately, there is a third option which makes this terrible idea slightly more practical. Digital signatures and related crypto tricks. Outlawing firewalls? Obviously implausible. Mandating firewalls that will pass certain traffic, or even modify their configurations, in response to orders cryptographically signed by some authority? Terrible idea; but not really any harder than SSH keypair logins.

      This would apply to pretty much any other security mechanism out there as well. AV scanners that ignore s
      • by gstoddart (321705)

        Outlawing firewalls? Obviously implausible. Mandating firewalls that will pass certain traffic, or even modify their configurations, in response to orders cryptographically signed by some authority? Terrible idea; but not really any harder than SSH keypair logins.

        Translation, a government mandated backdoor to all forms of security that they promise will only be accessible by them.

        The reality would be that we'd set computer security back by a decade or more, and we'd leave a hole big enough to drive a truck

    • But, of course, if your machine is behind a firewall, they'll just outlaw having firewall because it impedes their ability to investigate you for crimes. At which point if you need to be insecure enough to ensure that law enforcement can get in and do this, your machine will be hosed within the hour as the actual bad people break through as well.

      No, no, no... you have it all wrong. The police simply have to co-opt the Evil bit [wikipedia.org] to differentiate their traffic from the "bad guys," n00b!
  • More Information? (Score:5, Informative)

    by TripMaster Monkey (862126) on Tuesday December 02, 2008 @01:08PM (#25961589)

    Unfortunately, the article cited is maddeningly vague as to how this initiative will be implemented. A little digging turns up this Register article [theregister.co.uk] on the subject, which contains slightly more info.

    From the Register article:

    In practical terms, remote searches would involve planting law enforcement Trojans on suspects' PCs. Police in Germany are most enthusiastic about pushing this tactic, the sort of approach even Vic Mackey from The Shield might baulk at, despite its many potential drawbacks, highlighted by El Reg on numerous occasions.

    For starters, infecting the PC of a target of an investigation is hit and miss. Malware is not a precision weapon, and that raises the possibility that samples of the malware might fall into the hands of cybercrooks.

    Even if a target does get infected there's a good chance any security software they've installed will detect the malware. Any security vendor who agreed to turn a blind eye to state-sanctioned Trojans would risk compromising their reputation, as amply illustrated by the Magic Lantern controversy in the US a few years back.

    Then there are the civil liberties implications of the approach and questions about whether evidence obtained using the tactic is admissable in court.

    Despite all these problems the idea of a law enforcement Trojan continues to gain traction and could become mainstream within five years, if EU ministers get their way.

    So, in short, here's just one more compelling argument for ditching Windows for Linux...

    • Re:More Information? (Score:4, Informative)

      by dunkelfalke (91624) on Tuesday December 02, 2008 @01:30PM (#25961983)

      thank german minister for the interior for that shit. he introduced the law, the law was modded down by young social democrats, he was pretty pissed and so he tries to push the law through this way.

    • by meist3r (1061628)

      So, in short, here's just one more compelling argument for ditching Windows for Linux...

      Thinking of the manifold ways repositories can mess up your system and will bring the unexperienced users to tears I would doubt that statement. Read up on the Automatixx hoax a while back and you will know what I mean.

      • Granted....I'm just making the suggestion based upon the available information that says a Trojan will be involved, which will almost certainly be only written in the M$ flavor...90% of market share and all...

        However, as interest in Linux increases, it's only a matter of time before The Powers That Be take notice, and mucking with a repository would be a great way to snare an unsuspecting Linux user. All the more reason to support the growing Paranoid Linux [paranoidlinux.org] movement...I don't know exactly how effective thi

    • by nasor (690345)

      Police in Germany are most enthusiastic about pushing this tactic, the sort of approach even Vic Mackey from The Shield might baulk at...

      Off-topic and all, but didn't Vic Mackey routinely murder people? I somehow doubt that this would bother him...

    • So, in short, here's just one more compelling argument for ditching Windows for Linux...

      With more and more Linux users running proprietary binary blobs for convenience reasons or just out of pure laziness (video drivers, flash players and what not), it would be rather easy for $GOVERNMENT to remotely substitute one of those blobs with a "policeware"-augmented one with a classic man-in-the-middle attack. How could you check the code of those binary blobs to be sure that $THEY aren't already listening in wh

  • Worried? (Score:4, Funny)

    by seanellis (302682) on Tuesday December 02, 2008 @01:08PM (#25961591) Homepage Journal

    I would be worried that this would be badly worded and over-broad.

    But, being a citizen of the UK, I know that even if legislation were made like this, then Her Majesty's Government would never abuse its powers and apply it to situations which were not originally intended.

    Just like the anti-terrorism legislation.

    Oh, hang on...

    • Her Brittanic [Don't you mean Germanic - Ed] Majesty's government probably think they wouldn't need to search your machine to get your data.

      Because if their experience is anything to go by, everyone just leaves it lying around in taxis, trains, pub car parks and so on for anyone to find.

    • just like the dont shoot people who dont remotely not look like terrorists between they eyes on public transport

      oh wait

  • Go ahead (Score:5, Insightful)

    by Roland Piquepaille (780675) on Tuesday December 02, 2008 @01:12PM (#25961653)

    as I sit here in a cafe, my laptop connected to some unsecured AP far awqay with a biquad wifi antenna, I say go right ahead, search my hard-drive, but don't forget to bring a good map and a gonio antenna to find me in case you realize I'm not the poor guy whose house you're about to raid.

    This will never work, there are way too many anonymous internet connections around for this 1984 scheme to work, and people who have something to hide usually don't leave stuff hanging around unencrypted on their hard disks.

  • Will it be illegal to circumvent remote searches?

    I have a great idea for new security software... "Guaranteed to keep out those nosy government agents!"

  • All I am saying is that if this in anyway steals resources from my computer while I am playing computer games there will be hell to pay!
  • The EU said controls were in place to ensure that data protection laws were not breached as this information was gathered and shared.

    I'll go out on a limb here and say the controls aren't going to ensure this.

    EU data protection laws [europa.eu]

  • This is highly ambiguous, it could mean:
    • Planting spyware on suspect machines. With some operating systems this might be easy when remote, others they could do it if they can get undetected physical access.
    • Tweaks to the 'patch Tuesday' downloads. Quite possible, no one can verify against the sources since they can't see them. The does seem to be circumstantial evidence that MS has done this before; I wonder what their reward was?
    • Tweaks to the .deb/.rpm files for my favourite OS. Not possible you say ?
    • ...as usual this will only affect the people least likely to be the people they are looking for, and the ones they could easily catch with old fashioned methods, the people they want to catch will simply block and bypass it easily ....

      They will however inadvertently catch other criminals they were not intentionally trying to find and this will be hailed as a success and function creep will ensue ...

      • by Reziac (43301) *

        And eventually, it will become mandated software, giving you the option of becoming either a criminal, or a specimen under glass.

        Meanwhile, the real criminals hire expert programmers to create circumvention and false-data-stream tools. (And don't think there aren't enough programmers willing to do that ... even if not for their own protection, who do you think writes the many for-profit trojans right now??)

  • by fuzzyfuzzyfungus (1223518) on Tuesday December 02, 2008 @01:18PM (#25961789) Journal
    If the police are planning to "remote search" hard drives, they'll need something on the client that lets them do so, along with some sort of command and control/results reporting channel between the client and the (totally secure and definitely not going to get breached in an embarrassing display of incompetence that will go utterly unpunished) police HQ.

    In the short term, that means some flavor of spyware. The disconcerting bit, though, is that said spyware would look and act like normal spyware; but be part of a police investigation. Generally, interfering with those is a crime. Will removing that spyware be considered obstruction of justice? Will blocking its operations or reporting be considered obstruction of justice? "Your honor, the defendant did maliciously configure his router to drop outbound justice on port 315..." In order to be effective, spyware has to be covert and subtle, so it will be damn difficult to distinguish fedware from ordinary spyware.

    Worse, of course, is the medium to long term: if "remote search" is the law of the land, it will soon enough seem like a good idea to mandate a few features from hardware and software manufacturers to make it easier. Make an antivirus program? Well, you'd better be sure that it ignores the activities of any app signed by $AUTHORITY, if you want to stay out of jail. OSes could easily do similar things with process listings, priviledge escalations and the like. Even hardware could get in on the act. In principle, you could build obedience to cryptographically signed orders into all sorts of devices. This would be bad in all the ways that DRM usually is, only worse.

    Unfortunately, this sort of turn doesn't seem entirely unlikely. Digital surveillance is all the rage these days, and unlikely to get any less popular, and there are few jurisdictions that have any terribly encouraging history of resisting it. Specifically, the EU has comparatively strong privacy legislation; but it is written from the basic philosophy that privacy is having the state control other's access to the data it collects, rather than privacy being having those data never collected. The US is stronger on that score(at least in theory, and as long as drugs, kiddie porn, and terrorism aren't involved); but the state of private sector privacy is absolutely miserable and there is nothing stopping the state from simply buying surveillance from said private sector(which it indeed does, on a fairly massive scale).
    • by Reziac (43301) *

      And what happens when the remote search itself is compromised, and whatever some 3rd party wants is inserted into the data stream??

  • so what if you run Linux, how long before you legislate so they can get the router/ISP?

    yeah. it might hit botnets, spam, copy-right infringement (guess who will fund it) and other nefarious stuff - but the public will never allow it off the ground.
  • From European Data Protection Supervisor page [europa.eu]:

    The person whose data are processed - the data subject - enjoys a number of enforceable rights. This includes, for instance, the right to be informed about the processing and the right to correct data.

    Now how do you apply that to remote searches? Will they inform people they mistakenly "search" due to incorrect information?

  • Isn't this a way to claim to the brainless masses that they should dump all their computers and buy ones with the "trusted computing" platform? THEN the sh*t really would begin. Digitally signed and trusted trojans you can't to anything about.

  • I mean like, come on?

    Copied information vs stolen property, personal assault, rape, murder, ?

    • by Dunbal (464142)

      It's not in the government's best interest to solve violent crime. They WANT you to be afraid and lock your doors at night. It makes you nice and docile and grateful that the government is there to "protect" you - not that they will. So governments around the world make token efforts at catching real criminals, and usually give them a slap on the wrist before letting them go again - unless they are REALLY bad.

      Besides, it's much easier to do data mining to find "child pornographers"

    • Re: (Score:3, Insightful)

      by MrMr (219533)
      They need to move with the times. Classical crime rates have dropped so much since medieaval times that a whole new list of crimes has to be thought up to keep the enforcers busy.
      Not stealing imaginary property, smoking in a bar, drinking outside a bar, making juvenile jokes on an airplane...
  • ... then the rest of this sentence will NOT be "only outlaws will have firewalls," because that would be stupid. Rather, it will be rapid on-demand login and logout from the Internet, so that your system is only ON the Internet at moments at which it is sending data or intentionally receiving it. At other times it's just disconnected.

    However, because the press usually get wrong any story on a subject that I know something about, I have a feeling they've got this wrong too. I wonder what is *really* being p

  • I think we need to look at this from a lawyer's perspective. IANAL, but I think it might be easier to get a conviction on something like kiddie porn than on something like trafficking in stolen goods or illegally downloading 1000 songs.

    Think Al Capone. Murder? Smuggling? Racketeering? Naw, just get him on income tax evasion.

  • NO (Score:3, Funny)

    by unity100 (970058) on Tuesday December 02, 2008 @02:00PM (#25962487) Homepage Journal
    i wont allow it. and thats final.
    • I agree! They'll never get on my computer - wait, who's this General Protection-Fault? Is he one of their agents? Hey! He's reading my drives!
  • by Malluck (413074) on Tuesday December 02, 2008 @02:16PM (#25962767)

    It's real easy for them to do.

    Step 1 : Hand out free or discounted internet access. This may include higher than average datarates or fiber access making it really attractive to the end user. The caviout is that you must also run a software package on the machine or the connection is revoked. Said software includes the drive scanner and identification credentials.

    Step 2 : Pass regulation that makes traditional anonymous internet access prohibitivly expensive for the individual user.

    Ta da! The net is no longer anonymous and big brother is watching.

  • by gilgongo (57446) on Tuesday December 02, 2008 @03:48PM (#25964377) Homepage Journal

    From TFA: "In a statement outlining the strategy the EU claimed "half of all internet crime involves the production, distribution and sale of child pornography"

    What? Half of all internet crime??

    Hmmm. Bullshit detector's gone off the scale on this one. I think this is the work of industry lobbyists playing the child porn card to sell snakeoil to clueless, greedy politicians.

Everyone can be taught to sculpt: Michelangelo would have had to be taught how not to. So it is with the great programmers.

Working...