Feeds

Can writing software be a crime?

Depends if you're the government

  • alert
  • submit to reddit

Protecting against web application threats using SSL

Can writing software be a crime? A recent indictment in San Diego, California indicates that the answer to that question may be yes. We all know that launching certain types of malicious code - viruses, worms, Trojans, even spyware or sending out spam - may violate the law. But on July 21, 2005 a federal grand jury in the Southern District of California indicted 25 year old Carlos Enrique Perez-Melara for writing, advertising and selling a computer program called "Loverspy," a key logging program designed to allow users to capture keystrokes of any computer onto which it is installed. The indictment raises a host of questions about the criminalization of code, and the rights of privacy for users of the Internet and computers in general.

Like many nations, the United States has laws prohibiting the surreptitious eavesdropping of conversations. The federal law prohibits the "interception" of such communications while "in transmission," as well as the disclosure of the contents of any such unlawfully intercepted communications. Under federal law there are three exceptions to this. The first is where you are the government and you have either a Title III court order, a FISA court order, or what is called a "national security letter" permitting such interceptions. The second exception is where you are the "provider of communications facilities" and the interception is "in the ordinary course of business" and for particular stated purposes. Finally, the third exception is in situations where you have obtained the consent of at least one of the parties to the communication.

Thus, at least under federal law, it is legal to record a conversation, an e-mail, an internet communication if one and only one of the parties to the communication has given actual or implied consent to the "interception" or recording. Indeed, it is for this reason that most entities have "computer use policies" which explain that use of corporate computer systems implies their consent to monitoring of communications.

Loverspy and EmailPI

Carlos Enrique Perez-Melara developed, advertised and sold a spyware program called alternatively "Loverspy" or "E-Mail PI" on websites known as lover-spy.com or emailpi.com. They were sold for $89, and were advertised to be used to surreptitiously spy on anyone. The idea was that you would buy the Trojan program, e-mail it to your target (disguised in a greeting card) which would then cause the Trojan to be installed on any computer the purchaser directed it to - assuming the "victim" was dumb enough to open a greeting card from an ex-spouse.

Once installed, the Trojan gave the attacker full access to the victim's computer by logging keystrokes, capturing e-mail, capturing websites visited, and even allowing remote access to things like webcams and microphones. Thus, the software had several different components. First, it was able to be installed surreptitiously as a Trojan. Second, it had both a key logger or e-mail logging functionality. Third, it acted as a remote control client, similar to programs like MS Terminal Server or Remote User, or commercial software like GoToMy PC.

The government has prosecuted people under the federal wiretap laws for using keystroke loggers, most notably the indictment last year of Larry Lee Ropp, who at the time was an employee of Bristol West Insurance Group / Coast National Insurance company. Ropp installed physical key loggers onto his employers' computers to obtain evidence to support his assertion that the company was ripping off their customers. That case was dismissed when the federal judge ruled that the physical key logger, installed between the keyboard and the computer, did not capture communications "in interstate or foreign commerce" but rather captured them locally.

The Perez-Melara case, in comparison, represents the first time the government has attempted to prosecute the developer of a software that can be used for both lawful purposes (surreptitiously monitoring conversations with the consent of one party, or with the "implied" consent of an employee or a minor) or for unlawful purposes (eavesdropping without the consent of either party). To be sure, the government is also going after people who purchased and used the software. At the time Perez-Melara was indicted, the government also indicted four purchasers of the software for using the software to spy on ex-wives or girlfriends.

What exactly did Perez-Melara do that was illegal? Was it writing the software? Selling it? Advertising it? And how much illegal use must be made of the software before the software itself becomes a crime? There is all sorts of other software that can be used for legal and illegal purposes as well.

The wiretap law

In addition to criminalizing the actual interception, the U.S. law makes it a crime to either manufacture or possess any device if you have a reason to know that it is, "primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications." This statute has been used, for example, to go after these "spy stores" that sell things like concealed voice activated tape recorders. Or in 1974 (remember Watergate?) the statute was used to prosecute someone for advertising a mini tape recorder that, "secretly tapes a conversation, interview, conference or lecture in your shirt pocket." In fact, the statute was even used to prosecute the manufacturer of a suction cup microphone which you could attach to your telephone to record a conversation.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.