Feeds

Computer Misuse Act could ban security tools

Publishing software flaws now an offence?

Beginner's guide to SSL certificates

The new Police and Justice Act, published today, could criminalise legitimate IT security activity. There are fears among security experts that changes it makes to the Computer Misuse Act will make it illegal to distribute some vital tools.

The new law modifies the Computer Misuse Act of 1990, the cornerstone of Britain's anti-hacking law. The changes make clear for the first time that denial of service attacks are an offence, but they also address the distribution of hacking tools.

The new Act will make a person guilty of an offence "if he supplies or offers to supply any article believing that it is likely to be used to commit, or to assist in the commission of, [a hacking offence]". The word "article" is defined in the Act to include "any program or data held in electronic form".

Some software tools commonly used by IT security professionals can also be used for malicious purposes, making the new legislation a cause for concern.

"This applies particularly to dual use tools like nmap, which security professionals use to check if a network is insecure or not and which the bad guys use to scan for insecurities to then attack it," said Richard Clayton, a member of digital rights group the Open Rights Group and a security researcher at Cambridge University. "Distributors of this have to decide if the people getting it from them are the good guys or the bad guys."

Legal argument and uncertainty will surround what exactly constitutes "likelihood" to be used for malicious purposes. "The Home Office believes that likely is more than 50 per cent, so you have to have a trial within a trial to decide if it is more than 50 per cent likely that distribution is more likely than not to result in an offence being committed," said Clayton.

The final wording of the legislation is broader than was initially proposed. A version of the bill published in January 2006 (145 page/663KB PDF, at clause 35) made the offence contingent upon knowledge or intent that the article would be used for hacking; but the final version reduced that requirement to a belief that such use is likely.

The legislation may have been broadened as it went through Parliament to ensure that a person can be prosecuted if, for example, he posts software to the internet with a reckless disregard for its use.

Another fear of the new law is that it could be stretched to apply to warnings about security flaws and damage the ability of security firms to warn about third party software security breaches.

"The difficulty in the Act is that it says 'any item' and people are worried that that might include information about a piece of software's security vulnerability," said Clayton. "If you distribute information about a security vulnerability and the bad guys use it to attack it then the information about that vulnerability might qualify."

That could then allow software companies themselves to block publication of their products' flaws. "There are worries that software companies will use this to stop people publishing information about security flaws, to suppress that because they don't want the information out," said Clayton.

Security company Sophos said it did not plan to alter its practices, despite the law change. "We have no intention of changing our procedures in light of this legislation," said Carole Theriault, a spokeswoman for Sophos. "We don't believe it likely that any information relating to a computer threat supplied by us would be used to commit an offence.

"Trusted vendors in the security market provide information and tools to prevent security risks – certainly not to help them," said Theriault. "We are always careful – common sense dictates that we obfuscate information that might help someone contemplating online crime."

See:

Copyright © 2006, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Security for virtualized datacentres

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Apple CEO Tim Cook: TV is TERRIBLE and stuck in the 1970s
The iKing thinks telly is far too fiddly and ugly – basically, iTunes
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Huawei ditches new Windows Phone mobe plans, blames poor sales
Giganto mobe firm slams door shut on Microsoft. OH DEAR
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
OECD lashes out at tax avoiding globocorps' location-flipping antics
You hear that, Amazon, Google, Microsoft et al?
Show us your Five-Eyes SECRETS says Privacy International
Refusal to disclose GCHQ canteen menus and prices triggers Euro Human Rights Court action
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.