Feeds

German hacker-tool law snares...no-one

Security researchers are put out

SANS - Survey on application security programs

The COE treaty which the German law is intended to implement, noted that it was not intended to create criminal liability where "the production, sale, procurement for use, import, distribution or otherwise making available or possession ... is not for the purpose of committing a [computer crime] offence."

If I intend to facilitate some other crime like unauthorized access or destruction, then can’t I be prosecuted as a conspirator or aider and abettor even without this statute? Moreover, because the definition of computer crime hinges on the authorization to access or use a computer system or network, it is difficult if not impossible to determine whether the creation or distribution of the tool is intended to facilitate a crime. A wily hacker could simply say — with a wink and a nod — that the tool “should not be used to commit any crime,” and thereby escape liability.

Better laws needed

For all these reasons, the German statute is a mess.

While we can empathize with the desire to keep hacker tools out of the hands of script kiddies who intend harm, and keep black hat hackers from developing and distributing ever more sophisticated hacker tools and zero day attacks, the problem remains that these same tools can be and are used for good purposes by good people. While the statute attempts to focus on bad people with bad intent, it lacks the precision to do so.

There were a few cases where the German statute was challenged. The government investigated but declined to prosecute the online magazine Tec-Channel in September 2007, where someone offered a password cracker on the website. In that case, the Federal Office for Security in Information Technology (BSI) determined that there was no intent to violate section 202(c).

There has been a constitutional challenge to the statute. German law, like the law of many countries, requires that criminal statutes be sufficiently definite to describe precisely what is prohibited without overreaching and banning conduct which should be permissible. In Germany, this is codified in Article 103(2) of the fundamental laws of the Constitution.

Right after the law went into force, a German computer security company Visukom filed a lawsuit seeking to declare the statute to be unconstitutionally vague and prohibiting lawful and legitimate conduct. The case remains pending, and according to Visukom’s former president, should be decided later this year.

We should recognize that there are similar laws on the books in the UK, Poland and even in the United States. Amendments to the UK Computer Misuse Act in 2006 created a new section which makes it a crime if someone "makes, adapts, supplies or offers to supply any [program or data] intending it to be used to commit, or to assist in the commission of [a cybercrime] believing that it is likely to be so used."

Similarly, Article 269(b) of the Polish penal code states that, "whoever prepares, obtains, sells or makes available for other persons the computer devices or software tailored to the purposes of committing [a cybercrime], or prepares computer passwords, entry codes or other data that makes information stored in a computer system or network available” shall be guilty of a crime. While neither the United States nor Canada appear to have any explicit "hacker tools" statutes, the US makes it a crime to make or distribute hardware or software designed to get pirated cable or satellite TV signals.

Two years out, the German law has been effectively used to scare legitimate security researchers, while no reported cases have been brought against computer hackers for a violation of the hacker tools provision.

We should use the general laws against conspiracy and aiding and abetting crime — laws which require strict proof of intent to facilitate crime, or acting in concert to achieve an objective — rather than simply passing laws which, subject to the whim of the local prosecutor, could be used to criminalize legitimate conduct.

Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."

This article originally appeared in Security Focus.

Copyright © 2008, SecurityFocus

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.