EU wants to criminalize "Hacking Tools"

http://www.wired.com/threatlevel/2012/04/hacking-tools/

by drKarl • 14 years ago

169 120 14 years ago

wired.com

drKarl• 14 years ago

I wonder if they include most of the unix/linux command line tools like nmap, netcat, etc...

Laws about computers made by computer illiterates...

nitrogen5• 14 years ago

I believe I've heard that there are virus scanners that will immediately delete any copy of netcat they come across.

perlpimp• 14 years ago

Bold move but may undercut the knowledge base in EU in terms of Computer Security. Because in CompSec if you don't know how to break it, you don't know how to secure it. Hacker( the other meaning ) community is a part of the internet and a quote as old as internet is: The Net treats censorship as a defect and routes around it. -- John Gilmore.

dlsym• 14 years ago

In Germany there already is a law called "Hacker(tools)paragraf" (§ 202c StGB).

It roughly states, that if you provide, create, sell, or distribute tools, which can / will be used to commit / prepare a computer related crime, shall be punished with one year in prison or a fine.

The problem with this is the vague wording: If dual-use tools like nmap are affected is open to discussion.

Maybe someone else finds a better translation; you can find the original text here:

http://de.wikipedia.org/wiki/Hackerparagraf

Fargren• 14 years ago

How does that not affect every OS ever?

pagekalisedown• 14 years ago

I would hate to be someone teaching networking in Germany right now. This "paragraph" is throwing out the baby with the bath water.

jk4930• 14 years ago

After criticism they made clear that the good-intended use of those tools is legal.

fratido• 14 years ago

Yeah, german legislation for erveryone!</sarcasm> "Hacking tools" were made illegal 5 years ago in germany, resulting in a huge outcry and face palms from those involved in security research (and gnu-tool users)

jacquesm• 14 years ago

Sam gets arrested because he's carrying burglary tools at 03:00 in the morning and gets charged with burglary.

Defending himself he appears before the judge and asks the judge if they're going to accuse him of rape as well.

The judge, somewhat surprised at the turn of events bellows: "Don't tell me that you raped a woman as well?"

Sam responds: "No, obviously not. But I was carrying my tools.".

Even if you had the worst of the worst hacking tools sitting around on your system, it should be the actual use of those tools against someone else's machine for which you have no permission to access that creates the offence.

Those that break in to systems are not going to be deterred by this at all and those that make a living doing penetration tests and such will be unable to do their job giving the bad guys a nice advantage.

Silly lawmakers making silly laws with the best of intentions are the worst thing that can happen. I really wished they would limit their lawmaking to areas where they have some expertise.

TazeTSchnitzel2• 14 years ago

Yup. I don't think these people are smart enough to realise that making something illegal does not necessarily make something stop happening.

CodeMage• 14 years ago

Maybe I'm just too cynical, but I believe they are smart enough to realize that and they just don't care. Lawmaking in modern society is inextricably tied to politics and this seems yet another politically motivated piece of legislation.

glesica• 14 years ago

I agree with you that they probably aren't very smart, most of them anyway. However, if you bump up a cynicism level just a tad, here's what you get:

They don't need to stop people from possessing or using "hacking tools", they just need to make the tools illegal so they have one more stick with which to beat people into submission. In fact, it's better if people don't stop using the tools.

For example, say the government wants to do some extra-judicial harm to an annoying person or group (Wikileaks comes to mind). The company hosting the data won't cooperate, so the government "finds out" that they use unlicensed "hacking tools" as part of their business. Now the company is given a choice by the government: hand over the data we want (even though you aren't required to do so under the law) or we file charges for your possession of "hacking tools" and make life hell for your company and staff.

Now, don't get hung up on the details of my example. These sorts of situations are easy to think of and they happen all the time (article a while back about cops around St. Louis comes to mind).

The basic principle is that if everyone is a criminal, whether they intend to be or not, then the government has unlimited power over people through its ability to cut deals with criminals. It can coerce anyone to do anything regardless of constitutional or similar safeguards because it can punish anyone at any time.

Maybe you aren't that cynical (not sure I am, in fact), but I'd rather keep laws like this one off the books, just in case.

nextparadigms• 14 years ago

I agree. I hate this trend of criminalizing the use of tools, just like they wanted to criminalize the use of "circumvention tools" in SOPA, and if they keep this up in the future they'll probably want to criminalize encryption as well if it makes it hard for them to monitor the web with that NSA Utah datacenter or through some other ways.

rdtsc• 14 years ago

> they'll probably want to criminalize encryption as well

I believe there are countries where that is the case. So it is not really that outlandish. Export of encryption software was illegal until 10 or 15 years or so ago.

ericHosick• 14 years ago

Perhaps law makers should be limited to making laws that have actual victims.

slavak• 14 years ago

You probably meant to say "making laws against things that have actual victims," but this came out oddly appropriate...

aes2567• 14 years ago

> Even if you had the worst of the worst hacking tools sitting around on your system, it should be the actual use of those tools against someone else's machine for which you have no permission to access that creates the offence.

It's not quite that simple. Consider firearms. You might argue it should be the use of a firearm — to threaten, maim, or kill another person — that ought to be legislated against, not mere possession. Plenty of people disagree, as exemplified by the numerous democratic countries around the world where possession of a firearm is illegal in one form or another.

The obvious retort — the "guns don't kill people, people kill people" argument, if you will — is that possession of a tool alone should not be illegal because mere possession is not inherently harmful. That's the point you seem to be making here.

Indeed, both hacking tools and firearms can, in addition to their more obvious harmful uses, also be used to alleviate and even prevent harm — authorised penetration testing being the obvious example in the former case.

Nevertheless, plenty of people are willing to forego those benefits in the case of firearms; why not the same for hacking tools?

mjwalshe5• 14 years ago

Ironically not in Germany they do love their guns - probably a hangover from the 20's

And there are very few countries that explicitly ban all fire arms even the Uk which has very stringent laws still allows shotgun licenses.

nkassis2• 14 years ago

"Indeed, both hacking tools and firearms can, in addition to their more obvious harmful uses, also be used to alleviate and even prevent harm" they also have non-defense uses (Hunting, sports or network analysis in the other case). They are probably used for those things more than for criminal purposes.

I don't have to say that I am on the fence on certain aspect of gun control. Rules regulating storage (I'm from Canada) are in my view valid. So are rules on certain classes of guns. At the same time, any gun can kill so some of the restriction might not be useful but like I said I'm on the fence on a lot of these things.

snambi• 14 years ago

guns are not a good example. there is no way i can use a gun for constructive purpose.

think of a knife. 99.99% use the knife for good reasons. However, some use it to harm others. Does it make sense to outlaw knives?

I use wireshark often to see what goes into the request. A lot of developers use it. I think it is mostly used for good intentions.

yaix• 14 years ago

Firearms kill people by accident. Often.

Hacking tools don't kill people. And they rarely hack into a system by accident.

mrgoldenbrown• 14 years ago

Firearms are fairly well defined. Hacking tools are not, and most likely will not be well defined by the legislation. Is ping a hacking tool? Wireshark? tcpdump? a hex editor? telnet? all are used in hacking, but also have legitimate uses.

angersock3• 14 years ago

"Nevertheless, plenty of people are willing to forego those benefits in the case of firearms; why not the same for hacking tools?"

Those people legislate firearms out of fear and mistrust and insecurity...why should they be allowed to rule on hacking tools?

Duff2• 14 years ago

I think the difference, from the perspective of the regulator, is that a firearm is a tool with a limited scope of use, and that certain firearms (pistols) have a further limited scope of use that makes their existence noxious. In the US, the 2nd amendment makes this a controversial issue -- not so in most other jurisdictions.

Possession of burglary tools or drug paraphernalia is typically a modifier used to punish ill-intent. If I'm a carpenter walking home from work with a saw and hammer in my bag, I'm not going to be arrested for possessing burglar tools. If I'm trespassing on someone's property in the middle of the night with a crowbar, on the other hand, I'll probably be prosecuted for possessing burglar tools.

"Hacker tools" is sort of in the middle. A sysadmin with metasploit on his laptop is no different than a carpenter with his hammer. The Level-1 helpdesk technician pinched for stealing passwords is using it as a tool for doing "bad" things. The complication is that the line between "hacker tool" and "legitimate" software is thin or even overlapping.

Produce2• 14 years ago

But gun laws are backwards and make little sense when considering the violent crime statistics (e.g. the US has plenty of gun crime while Canada has comparatively little even though both have a gun carrying population). Guns don't kill people, people do. Anti-gun laws don't stop killings, they just give gangs and the police a monopoly on the most violent type of crime.

Gun laws are one of those things where intelligent, well meaning people replace reality with their model of reality and end up with a backwards system which does nothing to address the root causes. Hint: the root cause of violent crime has a lot to do with inequality, not the number of guns in someone's basement.

psb217• 14 years ago

Firearms are reifications of information, while hacking tools are information left incorporeal. Arguments founded on their equivalence are as devoid of meaning as those equating bits on a computer to cars on a lot.

Consider the following question: how long does a wire have to be before its ability to transfer information to me places that information in my possession? From both a philosophical and legal point of view, this question seems to permit no satisfying answer.

DannoHung• 14 years ago

Gun laws are only stupid in America because we have a Constitutional right to them. If the laws didn't get challenged based on their constitutionality, they'd be a lot more sane because they'd be a lot more broad.

tripzilch4• 14 years ago

> It's not quite that simple. Consider firearms.

... and then half the scrolling length of this discussion thread was about guns. Great job!

Actually it's not your fault, it's just HN terrible threading algo again. Can't we just do what Reddit does and collapse things a littlebit? Because it seems there's always some top comment (not always the top-most) that dominates 90% of the discussion. And frankly it's very hit-and-miss whether that dominating comment is on-topic or not.

We could have so much more interesting discussions here on HN ...

fromhet• 14 years ago

In my newly awaken state I first thought this was from The Onion. That's where it should be, at least.

adsr• 14 years ago

What is considered a hacking tool? Does it only affect highly automated, single purpose tools which can not be used in any legitimate way, or does it affect things like hexdump or nc?

Also, who makes the distinction? Is it eveluated on a case by case basis by the court or is there a list of "verboten" tools?

guard-of-terra• 14 years ago

Let me guess, it is evaluated on per case basis and then it gets into the list. Some stupid court in the middle of nowhere outlaws tcpdump and then every linux user is a criminat.

m0skit02• 14 years ago

They don't even know because most of this "clever" politicians have absolutely no idea what "hacking" actually means, let alone a "hacking tool"...

pyrhho• 14 years ago

Also, would this include just guessing passwords? As that seems to have fallen into the common definition of 'hacking'...

jjoergensen• 14 years ago

EU internet laws has no effect. Look at the cookie legislation that made it impossible to set cookies on peoples machines without explicit consent. What is dangerous is that one day they may be put into use. But for now they are just largely ignored.

zalew3• 14 years ago

Yeah, except recently our govt (Poland) got to this 'brilliant' idea http://hackerne.ws/item?id=3794883

//edit: original to translate in case the above doesn't work http://www.tvn24.pl/-1,1740364,0,1,rzad-bierze-sie-za-ciaste...

FreeFull• 14 years ago

That link only gives me an empty page

dasil003• 14 years ago

Actually I've already personally had the lawyers for a partner ram this one down my throat in the UK. It's absolutely ridiculous how out of their depth these legislators are. To take an idea that is readily implementable and enforceable at the browser level, but instead attempt to force every website operator in the world to implement it poorly at the server/application level is lunacy.

I'm all for privacy legislation, but in this case lawmakers' ignorance is only matched by their hubris.

aes2567• 14 years ago

Uh, the cookie directive isn't being ignored.

In the UK, for example, the directive was implemented on 26 May 2011, but website owners were granted a 12 month grace period to 'get their house in order'.

From 26 May 2012 site owners will face penalties for non-compliance.

TazeTSchnitzel2• 14 years ago

Brilliant. I commend the EU on its harsher stance on cyber security, cracking down on criminal computer usage and protecting the systems crucial to how we live our lives.</sarcasm>

So now we can't use penetration testing tools? I'm sure computer systems will be much more secure without the threat of security testing software, especially since the only threats we know of are from the EU.

Oh wait.

experiment0• 14 years ago

This type of legislation clearly stems from ignorance and a lack of understanding. It infuriates me that people can make judgements like this without actually understanding what they are making judgements on.

phn• 14 years ago

Well, a computer itself is an hacking tool, no?

m0skit02• 14 years ago

In fact your brain is a hacking tool, so everyone born with a working brain could go to jail.

bullseye• 14 years ago

Which means politicians would once again be exempt from the laws they create.

jiggy2011• 14 years ago

Wouldn't this in effect make credit card handling software etc impossible to create within the EU?

I'm fairly sure part of "due diligence" would be to perform some form of security audit / penetration test which this would render illegal.

Chris_Newton• 14 years ago

I suspect it's much worse than that. Consider a tool like Wireshark, which is widely used by people developing and testing all kinds of networking software, which in turn handle small tasks like running every home and office network on the planet, not to mention the Internet. Of course, any protocol analyser that you can hook up to your switch/router/etc. to make sure it's sending the right traffic in the right directions could also be stuck on a laptop near any unsecured WiFi network and used to sniff other network users' unencrypted traffic.

The correct solution to this problem, if secure communications is your primary concern, is for the people who understand the technical and security implications to make networking secure by default. Get rid of unsecured WiFi and replace it with something using full-time encryption.

It's also important to educate users of insecure networks so they understand the risks and know what to look out for and what they should do and not do to protect themselves. Use HTTPS where it's available, check you've got the little padlock icon before you type private information into a web site, that kind of thing. Obviously much of this is good practice if you're using the Internet, even if your immediate connection is over an encrypted wireless link.

Of course, there is always option 3: do nothing about the technical vulnerability, but legislate to ban Wireshark and numerous other "hacking tools" like it in the hope that bad people won't exploit that vulnerability. Unfortunately we'll probably have to close down the Internet shortly afterwards and revert to connecting a printer to everyone's PC at the office so they can exchange documents, because no-one will be able to make any networking kit that actually works any more. But that's a small price to pay, for at least we will have stopped Evil Hackers from monitoring our networks!

(Obviously there's a little hyperbole in that last part. But only a little...)

Craiggybear4• 14 years ago

Everything is a hacking tool. Every programming language and every pre-existing piece of software, every computer and every phone is a potential hacking tool. Thought itself is the biggest hacking tool.

How are these fucking morons going to define legally what is and isn't a "hacking tool"?

neilk• 14 years ago

The law has no trouble at all making fuzzy distinctions. They are attempting to keep the peace, not make orthogonal cuts into reality.

We programmers need absolute clarity because our systems are executed by machines with no insight. But in other fields where humans execute rules, everyone else just shrugs and deals with little inconsistencies, or make meta-rules about judging "intent", that sort of thing.

tripzilch4• 14 years ago

> The law has no trouble at all making fuzzy distinctions.

Actually, in most of Europe it does.

While the US, UK and Ireland's legal system is based on "Common Law", most of Europe uses "Civil Law", where the primary source of law is the law code, which is a systematic collection of interrelated articles that explain the principles of law, rights and entitlements, and how basic legal mechanisms work.

Of course there's still a lot of room for interpretation and pragmatics, but the point is that right from the start, you try to get your definitions down as clear as possible.

It's quite interesting to see how the fundamentals of our legal systems actually differ. I decided to look this up for the first time because at some point I read some thread where some US people were actively discussing interpretation of your Constitution or the Bill of Rights, as to whether something fairly trivial to define could be ruled or not--might even have had to do with the right to bear arms, but the specifics aren't important. I was just amazed that this centuries-old document was seriously being "consulted" as if somewhere between the lines would appear some sort of hidden meaning--except it was pretty obvious that the final decision would rest with the interpretation and political ideas of whatever judge got to rule it. Which completely amazed me, it's one thing if somnewhere, in some obscure corner of fiscal tax laws some particular exception to a rule isn't defined unambiguously, but the big-to-medium picture of the law is not supposed to be up for interpretation!

Except in the US, or more precisely in Common Law legal systems, that's pretty much the idea.

I'm not saying it's bad BTW, it's just different. And I'm just commenting on how surprised I was that there's other ways (in democratic countries) than to strictly codify your laws.

[1] http://en.wikipedia.org/wiki/Common_law#2._Common_law_legal_...

[2] http://en.wikipedia.org/wiki/Civil_law_(legal_system)

aes2567• 14 years ago

This is 'hacking' a la the popular meaning of the term (gaining unauthorised entry to a computer system), not the definition adopted by self-described 'hackers'.

Think port scanners, password crackers, vulnerability identification and exploitation tools. Any reasonable person would consider these to be 'hacking tools', and that's all a legal system needs for a definition.

Craiggybear4• 14 years ago

"Think port scanners, password crackers, vulnerability identification and exploitation tools. Any reasonable person would consider these to be 'hacking tools'"

But, once again, these are all perfectly legitimate system engineering tools and are essential for hardening commercial or government or military sites, for example. You can't make something secure unless you know how easy or hard it will be to get past that.

It is like making dynamite illegal for civil engineers or morphine forbidden to medical practitioners or hammers and chisels denied to cabinet makers because they might hurt themselves. Ridiculous!

nkassis2• 14 years ago

As an ex network admin, not having port scanners and vulnerability testing tools would make me feel blind. Those tools have very legitimate uses. Port scanners don't even have to be used for security purposes, sometimes you can't access a machine and want to see what services are active and open to the world etc.

zalew3• 14 years ago

> How are these fucking morons going to define legally what is and isn't a "hacking tool"?

They won't. They'll just use the broad qualifications to opress the ones they don't feel comfortable with.

Craiggybear4• 14 years ago

Ah, of course. How stupid of me to think that they would have an empirical definition or set of legal definitions that actually was robust and made coherent sense.

Why bother with the hard stuff when opinionated prejudice gets you where you want to go?

richieb• 14 years ago

Isn't a computer a "hacking tool"?

randomdata• 14 years ago

This seems like the obvious ban. If you outlaw computers, honest people won't be able to use them, leaving no systems for the dishonest people to hack into.

mjwalshe5• 14 years ago

Yes and so are floppy disks - the only hacking (authorised) I had to do was to recover paswords for a customer and I used a floppy disk to extract the secrets from the nt machines.

verelo• 14 years ago

How far doe this go?

Can i have a laptop with vi or nmap installed? I imagine most DOS attacks come from people with a pretty generic install, vi and an internet connection.

doki_pen2• 14 years ago

The argument that this would hurt legitimate hacking is a bad one. The example given was white hats hacking into e-voting machines. You aren't allowed to break into government buildings to make sure they are secure, it's illegal.

As far as preventative laws go, I don't think they are right but they are widely accepted by most people as right. I'll use one that most people agree with as an example. Drunk driving in and of itself doesn't hurt anyone, and some people can do it their entire lives without ever getting in an accident. But we make it illegal to try and prevent people from killing each other.

mattstreet• 14 years ago

Yes you can't break into government buildings to show they are insecure, but you could buy the same kind of door as they have, and show how insecure it is.

I think this is how a lot of the e-voting machine hacks are done.

dguido• 14 years ago

This article is a little bit sensationalist. Here is analysis of the actual text of the law:

http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t...

jakeonthemove• 14 years ago

Well, I don't know what to say - this is just stupid. I hope it doesn't go through, but if it does, I'll just store all the potential "hacking tools" on a server in the US, or China, or Japan, or Brazil, or Australia... or encrypted UHS SD cards (it took them a while, but they already know about encrypted hard drives, you see :-)... Seriously, how is this even going to be enforceable (especially with the push for cloud storage)?

siculars• 14 years ago

So would Chrome and Mozilla have to disable "view source" and "developer mode"? Would Apple have to stop shipping Xcode? Would I have to register with an "authority" as a developer? Like a boxer registering his fists as "deadly weapons"?

The insanity continues...

lvh• 14 years ago

This is a dupe. Original source: http://news.ycombinator.com/item?id=3797026

When the original got posted, I already called the MEP in question:

http://news.ycombinator.com/item?id=3797114

TL;DR: They already know this is silly and the final law text will not criminalize tools being used in a research/penetration testing context.

Nothing to see here, move along...

cs702• 14 years ago

Almost all politicians in power today (1) didn't grow up with a pervasive Internet, and (2) truly don't understand information technology. For example, the median age of US Senators is currently 62 years [1], and not a single one of them is an engineer (let alone a software developer) [2].

Consider how the term "dangerous hacking tool" sounds to a 62 year-old person who doesn't have even a basic understanding of how software works. No wonder they want to outlaw these "weapons"!

Alas, it's probably too late and too difficult to teach these old dogs new tricks. Realistically, we should expect more idiotic political decisions to be made... until a new generation of politicians (with a better understanding of software and the Internet) gradually takes over.

I wish I could be more optimistic about this.

[1] http://en.wikipedia.org/wiki/List_of_current_United_States_S...

[2] http://www.senate.gov/reference/resources/pdf/R41647.pdf

harshreality4• 14 years ago

It's not obvious that the next generation of politicians will be much better. Using computers, including iOS and Android devices, is not enough. Technically minded individuals who understand how those devices work below the surface are still unlikely to go into politics.

archgoon• 14 years ago

The Low Orbit Ion Cannon isn't a DDoS tool, it's a crowd sourced network stress testing utility!

redbeard0x0a• 14 years ago

What about hacking tools that have been installed on your machine without your knowledge, i.e. malware that runs DDoS attacks?

godDLL• 14 years ago

> While the law seems aimed at blackmarket tools that can be used to create malware infested sites, it’s also likely to criminalize tools used by researchers, developers and black hats alike – including tools like fuzzers, the Metasploit penetration testing tool and the wi-fi sniffing tool Wireshark. (Perhaps even the command line would be outlawed.)

They take away your guns, so that you can not rebel against them.

pbhjpbhj• 14 years ago

It's already illegal in the UK to enter and/or use a computer system without permission, you don't even have to crack it. Presumably this is true in most of the EU too.

So, the only reason I can see that anyone would want this law is so you can prosecute without having to show someone committed a real crime. Kinda like having a law saying you could prosecute people for hit-and-run if they own a car.

If the "hacking tools" are capable of causing near instantaneous death then I think there's an argument for it. Otherwise this seems to be over-stretching the law to infringe on hackers liberties.

alexqgb• 14 years ago

The temptation to pass laws like this (an unstoppable force) exists in fundamental opposition to the reality of tools as powerful, as versatile, as cheap, and as highly distributed personal computers (the immovable object).

This conflict is the essence of Cory Doctorow's thesis that all the superficially-unrelated tech related battles we've seen are simply proxy fights in the War on General-Purpose Computing.

I know that opinions about Cory vary considerably, but if there's one article that everyone should consider with an open mind, this is it: http://boingboing.net/2012/01/10/lockdown.html

antihero• 14 years ago

If you are in the UK, please consider writing to your MEP(s):

http://www.writetothem.com

urza• 14 years ago

We need to reinvent the law making! The current system is simply outdated.

rosser• 14 years ago

"Perhaps even the command line would be outlawed."

Jesus, Wired. Sensationalize much?

mgogov• 14 years ago

I live in the EU and this is simply ridiculous.

EU wants to criminalize "Hacking Tools"

Related Stories