Feeds

European Council: Creating hacking tools should be criminal across EU

Ministers want Europe-wide legal net for cybercrookery

5 things you didn’t know about cloud backup

The making of hacking tools and computer viruses should be a criminal act across Europe, EU ministers have said.

The EU's Council of Ministers has backed the extension of criminal sanctions to tool—makers in response to European Commission plans to update EU laws tackling attacks against computer systems.

Responding to European Commission plans to create a new anti-hacker Directive, the Council has said that the making of hacking tools should be criminalised, adding this to the list of currently criminal practices.

"The following new elements [should include] penalisation of the production and making available of tools (eg, malicious software designed to create 'botnets' or unrightfully obtained computer passwords) for committing the offences [of attacks against computer systems]," the Council of Ministers said in a statement (pages 18-19 of 38-page/176KB PDF).

"The term botnet indicates a network of computers that have been infected by malicious software (computer virus)," the Council statement said.

"Such network of compromised computers ('zombies' may be activated to perform specific actions such as attacks against information systems (cyberattacks). These 'zombies' can be controlled – often without the knowledge of the users of the compromised computers – by another computer," the Council statement said.

The creation of the kinds of tools outlined in the new plans is already a criminal offence in the UK. The Computer Misuse Act says that making, supplying or obtaining articles for use in hacking is a criminal offence and carries a maximum prison term of up to two years and a fine.

Under the Act a person is guilty of an offence if he "makes, adapts, supplies or offers to supply any article intending it to be used to commit, or to assist in the commission of, [a hacking offence]." The word "article" is defined in the Act to include "any program or data held in electronic form".

Illegal interception of computer data will also become a criminal offence under the Council's plans, the statement said.

The proposals also suggest that there should be an obligation for EU countries to report computer system attacks within eight hours to existing contact points to improve European cooperation in criminal matters.

It should be a mandatory requirement for EU countries to collect basic statistical data on cybercrimes, the Council also said in its proposals.

The new measures should add to existing laws for penalising computer system attacks, the Council said.

"The new rules would retain most of the provisions currently in place – namely the penalisation of illegal access, illegal system interference and illegal data interference as well as instigation, aiding, abetting and attempt to commit those criminal offences," the Council said in its statement.

Criminal penalties for computer system attacks should be increased, the Council said.

"The new rules would raise the thresholds if the attack has been committed by an organised criminal group, or has caused serious damage, eg, through the use of a 'botnet', or has affected a critical IT system, to a maximum term of imprisonment of at least five years," the Council said.

General cases of computer system attacks should result in offenders facing a maximum jail sentence of at least two years, and punishment for offences committed against a "significant number" of systems should be a maximum of at least three years jail time, the Council said.

"These new forms of aggravating circumstances are intended to address the emerging threats posed by large scale cyberattacks, which are increasingly reported across Europe and have the potential to severely damage public interests," the Council said in its statement.

The Council, which is formally called the Council of the European Union, is made up of 27 ministers representing each EU state. Ministers share law-initiating duties with members of the European Parliament. The Council will use the general proposals as the basis of negotiations with the Parliament over what exactly should be included in the new laws, the Council's statement said.

The UK and Ireland must implement the new rules of the new Directive into national law but Denmark will not be bound by them, the Council said.

Copyright © 2011, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.