Feeds

Germany floats Trojan for terror suspects

Baldrick-style cunning plan

SANS - Survey on application security programs

German politicians have defended plans to email Trojan horse software to terror suspects in the hopes of monitoring their conversations. The measures have sparked a fierce civil liberties debate. The dubious efficacy of the wheeze is yet to come under serious consideration.

Interior Minister Wolfgang Schaeuble is seeking police powers to harness malware in upcoming federal security laws. AP reports that snoopware would be developed by the German government rather than existing commercial software. Using malware to spy on terror suspects would "cover a serious and scandalous hole in our information that has arisen through technical changes in recent years," according to Stefan Kaller, a spokesman for Schaeuble.

It would, of course, be far more straightforward to bug the PCs of suspects by physically planting keystroke monitors or the like to their machines, rather than chancing matters to email. Proposals to give explicit permission for law enforcement officials to plant such malware stems from a Federal Court ruling earlier this year declaring clandestine searches of suspects' computers to be inadmissible as evidence pending a law regulating the practice. Germany's Federal Court of Justice said that the practice was not covered by existing lawful surveillance legislation.

The Bill is yet to be finalised, but proposals leaked to the German media involve the idea of booby trapping messages ostensible from the German Finance Ministry or the Youth Services Office.

Would-be terrorists need only use Ubuntu Linux to avoid the ploy. And even if they stuck with Windows their anti-virus software might detect the malware. Anti-virus firms that accede to law enforcement demands to turn a blind eye to state-sanctioned malware risk undermining trust in their software, as similar experience in the US has shown.

Once the malware gets into circulation there's no guarantee it won't be turned against innocent users.

The whole concept is loaded with irony. For one thing, German government computers, like those in the UK before them, are currently under targeted Trojan assault. Meanwhile, recently introduced German legislation criminalises possession of hacking tools through vaguely worded measures that also appear to make network security tools illegal, though this is yet to be tested in court.

Altogether the German Trojan proposals are a thoroughly bad idea. ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.