Feeds

Germany floats Trojan for terror suspects

Baldrick-style cunning plan

5 things you didn’t know about cloud backup

German politicians have defended plans to email Trojan horse software to terror suspects in the hopes of monitoring their conversations. The measures have sparked a fierce civil liberties debate. The dubious efficacy of the wheeze is yet to come under serious consideration.

Interior Minister Wolfgang Schaeuble is seeking police powers to harness malware in upcoming federal security laws. AP reports that snoopware would be developed by the German government rather than existing commercial software. Using malware to spy on terror suspects would "cover a serious and scandalous hole in our information that has arisen through technical changes in recent years," according to Stefan Kaller, a spokesman for Schaeuble.

It would, of course, be far more straightforward to bug the PCs of suspects by physically planting keystroke monitors or the like to their machines, rather than chancing matters to email. Proposals to give explicit permission for law enforcement officials to plant such malware stems from a Federal Court ruling earlier this year declaring clandestine searches of suspects' computers to be inadmissible as evidence pending a law regulating the practice. Germany's Federal Court of Justice said that the practice was not covered by existing lawful surveillance legislation.

The Bill is yet to be finalised, but proposals leaked to the German media involve the idea of booby trapping messages ostensible from the German Finance Ministry or the Youth Services Office.

Would-be terrorists need only use Ubuntu Linux to avoid the ploy. And even if they stuck with Windows their anti-virus software might detect the malware. Anti-virus firms that accede to law enforcement demands to turn a blind eye to state-sanctioned malware risk undermining trust in their software, as similar experience in the US has shown.

Once the malware gets into circulation there's no guarantee it won't be turned against innocent users.

The whole concept is loaded with irony. For one thing, German government computers, like those in the UK before them, are currently under targeted Trojan assault. Meanwhile, recently introduced German legislation criminalises possession of hacking tools through vaguely worded measures that also appear to make network security tools illegal, though this is yet to be tested in court.

Altogether the German Trojan proposals are a thoroughly bad idea. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.