Feeds

Can writing software be a crime?

Depends if you're the government

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

The law also makes it a crime to disseminate by electronic means an advertisement of an eavesdropping device if you know or even just have reason to know that "the design of such [a] device renders it primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications." This also works if you promote the use of the device for surreptitious interception. There is little doubt that LoverSpy, like hundreds of other devices, was advertised as being useful for surreptitious interception.

These laws make no distinction between secretly spying on my own computer, and secretly spying on computers of others. Thus, if I install such a program in my own computer because I suspect that someone may be using the computer without my authorization, I may be violating the wiretap law, and the manufacturer of the program may likewise be committing a felony. If I install a key logger or other monitoring program to keep my kids away from porn sites (or to monitor them if they do go there) my actions may be legal but the sale and distribution of the software used may be illegal. What if I use this software on my own computers to ensure my children don't become victims of stalkers, or companies that violate the Children's On-line Privacy Protection Act (COPPA)? Again, my actions may be legal assuming - and this is a big assumption - that I am authorized to give "consent" to the interception of their communications without their knowledge. In fact, under federal conspiracy law, while my use of the software may have been legal, I may have conspired with the software developer to sell the product, and therefore may be guilty of a crime just by buying software I can otherwise use legally. In addition, while a program may be useful for surreptitious interception, and may even be advertised that way, it may be equally useful for lawful purposes. Nevertheless, as the indictment shows, the software may be illegal.

As with the Groskter case decided by the U.S. Supreme Court, the Perez-Melara case points out that you can make software illegal simply by promoting or advertising its usefulness for illegal or infringing purposes. In the Groskter case, the Supreme Court suggested that the program might not be unlawful if it had substantial non-infringing uses and was promoted for such uses. Perhaps the same is the case for Trojanized key loggers?

A foolish consistency

Another problem with the Perez-Melara case is that the government's theory is directly opposite the position it took when they wanted to install a Trojanized key logger onto a computer without a Title III wiretap order.

In the case of reputed Philadelphia mob boss "little Nicky" Scarfo, the government got a court order to install a key logger onto his computer. Scarfo objected to the introduction of evidence captured by the key logger, claiming that even though the government had a warrant to surreptitiously install the key logger, the program captured electronic communications in transmission, and therefore the government was required to get a more restrictive wiretap order to retrieve the captured communications. The government vehemently disagreed, claiming that the key logger did not "capture" any communications in transmission, and therefore a simple subpoena or search warrant would suffice.

As Ralph Waldo Emerson noted, "A foolish consistency is the hobgoblin of little minds." Indeed, at what point does a wiretap "capture" a communication in transmission? For example, when the government wanted to gather evidence against NSA contract employee Brian Regan for spying for Libya, instead of installing a key logger they simply put a video camera pointed at the monitor. Voila! Wiretap issue solved!

Lessons learned

Software developers need to be aware of potentially illegal uses of the software that they develop, market and sell. While they generally will not be held liable for such illegal uses, they may have some liability if they know or reasonably should know about the illegal or infringing use, particularly if they advertise or promote the usefulness of the software for such use.

This could be applied, for example, to anonymizing programs, wipe or delete programs, evidence eliminators, or even (potentially) access control programs, if developers know or should know that these will be used for obstruction of justice. It is kind of like holding manufacturers of shredders liable for their use by Enron, or holding gun manufacturers liable when their guns are used for illegal purposes. Oh wait, Congress just exempted gun manufacturers from such liability. Keep your eyes open to see how this one ends.

Copyright © 2005, SecurityFocus

Mark D. Rasch, J.D., is a former head of the Justice Department's computer crime unit, and now serves as Senior Vice President and Chief Security Counsel at Solutionary Inc.

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.