Feeds

German hacker-tool law snares...no-one

Security researchers are put out

Security for virtualized datacentres

The COE treaty which the German law is intended to implement, noted that it was not intended to create criminal liability where "the production, sale, procurement for use, import, distribution or otherwise making available or possession ... is not for the purpose of committing a [computer crime] offence."

If I intend to facilitate some other crime like unauthorized access or destruction, then can’t I be prosecuted as a conspirator or aider and abettor even without this statute? Moreover, because the definition of computer crime hinges on the authorization to access or use a computer system or network, it is difficult if not impossible to determine whether the creation or distribution of the tool is intended to facilitate a crime. A wily hacker could simply say — with a wink and a nod — that the tool “should not be used to commit any crime,” and thereby escape liability.

Better laws needed

For all these reasons, the German statute is a mess.

While we can empathize with the desire to keep hacker tools out of the hands of script kiddies who intend harm, and keep black hat hackers from developing and distributing ever more sophisticated hacker tools and zero day attacks, the problem remains that these same tools can be and are used for good purposes by good people. While the statute attempts to focus on bad people with bad intent, it lacks the precision to do so.

There were a few cases where the German statute was challenged. The government investigated but declined to prosecute the online magazine Tec-Channel in September 2007, where someone offered a password cracker on the website. In that case, the Federal Office for Security in Information Technology (BSI) determined that there was no intent to violate section 202(c).

There has been a constitutional challenge to the statute. German law, like the law of many countries, requires that criminal statutes be sufficiently definite to describe precisely what is prohibited without overreaching and banning conduct which should be permissible. In Germany, this is codified in Article 103(2) of the fundamental laws of the Constitution.

Right after the law went into force, a German computer security company Visukom filed a lawsuit seeking to declare the statute to be unconstitutionally vague and prohibiting lawful and legitimate conduct. The case remains pending, and according to Visukom’s former president, should be decided later this year.

We should recognize that there are similar laws on the books in the UK, Poland and even in the United States. Amendments to the UK Computer Misuse Act in 2006 created a new section which makes it a crime if someone "makes, adapts, supplies or offers to supply any [program or data] intending it to be used to commit, or to assist in the commission of [a cybercrime] believing that it is likely to be so used."

Similarly, Article 269(b) of the Polish penal code states that, "whoever prepares, obtains, sells or makes available for other persons the computer devices or software tailored to the purposes of committing [a cybercrime], or prepares computer passwords, entry codes or other data that makes information stored in a computer system or network available” shall be guilty of a crime. While neither the United States nor Canada appear to have any explicit "hacker tools" statutes, the US makes it a crime to make or distribute hardware or software designed to get pirated cable or satellite TV signals.

Two years out, the German law has been effectively used to scare legitimate security researchers, while no reported cases have been brought against computer hackers for a violation of the hacker tools provision.

We should use the general laws against conspiracy and aiding and abetting crime — laws which require strict proof of intent to facilitate crime, or acting in concert to achieve an objective — rather than simply passing laws which, subject to the whim of the local prosecutor, could be used to criminalize legitimate conduct.

Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."

This article originally appeared in Security Focus.

Copyright © 2008, SecurityFocus

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.