Feeds

European Council: Creating hacking tools should be criminal across EU

Ministers want Europe-wide legal net for cybercrookery

Choosing a cloud hosting partner with confidence

The making of hacking tools and computer viruses should be a criminal act across Europe, EU ministers have said.

The EU's Council of Ministers has backed the extension of criminal sanctions to tool—makers in response to European Commission plans to update EU laws tackling attacks against computer systems.

Responding to European Commission plans to create a new anti-hacker Directive, the Council has said that the making of hacking tools should be criminalised, adding this to the list of currently criminal practices.

"The following new elements [should include] penalisation of the production and making available of tools (eg, malicious software designed to create 'botnets' or unrightfully obtained computer passwords) for committing the offences [of attacks against computer systems]," the Council of Ministers said in a statement (pages 18-19 of 38-page/176KB PDF).

"The term botnet indicates a network of computers that have been infected by malicious software (computer virus)," the Council statement said.

"Such network of compromised computers ('zombies' may be activated to perform specific actions such as attacks against information systems (cyberattacks). These 'zombies' can be controlled – often without the knowledge of the users of the compromised computers – by another computer," the Council statement said.

The creation of the kinds of tools outlined in the new plans is already a criminal offence in the UK. The Computer Misuse Act says that making, supplying or obtaining articles for use in hacking is a criminal offence and carries a maximum prison term of up to two years and a fine.

Under the Act a person is guilty of an offence if he "makes, adapts, supplies or offers to supply any article intending it to be used to commit, or to assist in the commission of, [a hacking offence]." The word "article" is defined in the Act to include "any program or data held in electronic form".

Illegal interception of computer data will also become a criminal offence under the Council's plans, the statement said.

The proposals also suggest that there should be an obligation for EU countries to report computer system attacks within eight hours to existing contact points to improve European cooperation in criminal matters.

It should be a mandatory requirement for EU countries to collect basic statistical data on cybercrimes, the Council also said in its proposals.

The new measures should add to existing laws for penalising computer system attacks, the Council said.

"The new rules would retain most of the provisions currently in place – namely the penalisation of illegal access, illegal system interference and illegal data interference as well as instigation, aiding, abetting and attempt to commit those criminal offences," the Council said in its statement.

Criminal penalties for computer system attacks should be increased, the Council said.

"The new rules would raise the thresholds if the attack has been committed by an organised criminal group, or has caused serious damage, eg, through the use of a 'botnet', or has affected a critical IT system, to a maximum term of imprisonment of at least five years," the Council said.

General cases of computer system attacks should result in offenders facing a maximum jail sentence of at least two years, and punishment for offences committed against a "significant number" of systems should be a maximum of at least three years jail time, the Council said.

"These new forms of aggravating circumstances are intended to address the emerging threats posed by large scale cyberattacks, which are increasingly reported across Europe and have the potential to severely damage public interests," the Council said in its statement.

The Council, which is formally called the Council of the European Union, is made up of 27 ministers representing each EU state. Ministers share law-initiating duties with members of the European Parliament. The Council will use the general proposals as the basis of negotiations with the Parliament over what exactly should be included in the new laws, the Council's statement said.

The UK and Ireland must implement the new rules of the new Directive into national law but Denmark will not be bound by them, the Council said.

Copyright © 2011, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.