Feeds

European Council: Creating hacking tools should be criminal across EU

Ministers want Europe-wide legal net for cybercrookery

Intelligent flash storage arrays

The making of hacking tools and computer viruses should be a criminal act across Europe, EU ministers have said.

The EU's Council of Ministers has backed the extension of criminal sanctions to tool—makers in response to European Commission plans to update EU laws tackling attacks against computer systems.

Responding to European Commission plans to create a new anti-hacker Directive, the Council has said that the making of hacking tools should be criminalised, adding this to the list of currently criminal practices.

"The following new elements [should include] penalisation of the production and making available of tools (eg, malicious software designed to create 'botnets' or unrightfully obtained computer passwords) for committing the offences [of attacks against computer systems]," the Council of Ministers said in a statement (pages 18-19 of 38-page/176KB PDF).

"The term botnet indicates a network of computers that have been infected by malicious software (computer virus)," the Council statement said.

"Such network of compromised computers ('zombies' may be activated to perform specific actions such as attacks against information systems (cyberattacks). These 'zombies' can be controlled – often without the knowledge of the users of the compromised computers – by another computer," the Council statement said.

The creation of the kinds of tools outlined in the new plans is already a criminal offence in the UK. The Computer Misuse Act says that making, supplying or obtaining articles for use in hacking is a criminal offence and carries a maximum prison term of up to two years and a fine.

Under the Act a person is guilty of an offence if he "makes, adapts, supplies or offers to supply any article intending it to be used to commit, or to assist in the commission of, [a hacking offence]." The word "article" is defined in the Act to include "any program or data held in electronic form".

Illegal interception of computer data will also become a criminal offence under the Council's plans, the statement said.

The proposals also suggest that there should be an obligation for EU countries to report computer system attacks within eight hours to existing contact points to improve European cooperation in criminal matters.

It should be a mandatory requirement for EU countries to collect basic statistical data on cybercrimes, the Council also said in its proposals.

The new measures should add to existing laws for penalising computer system attacks, the Council said.

"The new rules would retain most of the provisions currently in place – namely the penalisation of illegal access, illegal system interference and illegal data interference as well as instigation, aiding, abetting and attempt to commit those criminal offences," the Council said in its statement.

Criminal penalties for computer system attacks should be increased, the Council said.

"The new rules would raise the thresholds if the attack has been committed by an organised criminal group, or has caused serious damage, eg, through the use of a 'botnet', or has affected a critical IT system, to a maximum term of imprisonment of at least five years," the Council said.

General cases of computer system attacks should result in offenders facing a maximum jail sentence of at least two years, and punishment for offences committed against a "significant number" of systems should be a maximum of at least three years jail time, the Council said.

"These new forms of aggravating circumstances are intended to address the emerging threats posed by large scale cyberattacks, which are increasingly reported across Europe and have the potential to severely damage public interests," the Council said in its statement.

The Council, which is formally called the Council of the European Union, is made up of 27 ministers representing each EU state. Ministers share law-initiating duties with members of the European Parliament. The Council will use the general proposals as the basis of negotiations with the Parliament over what exactly should be included in the new laws, the Council's statement said.

The UK and Ireland must implement the new rules of the new Directive into national law but Denmark will not be bound by them, the Council said.

Copyright © 2011, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Remote control for virtualized desktops

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.