5 ms·

If there is a reasonable suspicion I don't see the problem with giving law enforcement the legal ability to hack their targets. This is something very different

by SCHiM 11y ago

If there is a reasonable suspicion I don't see the problem with giving law enforcement the legal ability to hack their targets. This is something very different from drag-net surveillance and should not be tainted with the same stigma. It's not like the government actually _needs_ or wants to maintain giant botnets of all the targets they've hacked.

nitrogen 11y ago
If such a thing is allowed, then higher standards should be applied to forced digital entry by police than are applied to forced physical entry. Also, one very bothersome side effect of government-sanctioned hacking is that governments have an incentive not to notify software vendors about vulnerabilities.
belorn 11y ago
Withholding known security vulnerabilities from the public in order to be later used for hacking is immoral and dangerous. Imagine if the police had prior knowledge of a vulnerability in the computer system of a car, but did not act to protect the public. A few years later a criminal figure out the same vulnerability and causes a major car crash on a motorway and murder several people. I would view the police officer to be found liable under breach of duty, same as if they witnessed a crime and refused to act. Under the same logic, if companies has a legal responsibility to protect their customers and provide safe products, and police officers has a professional responsibility to report crimes, then the police should be forced to act if they have confirmed information about a security vulnerability.
- cornedor 11y ago
  > if companies has a legal responsibility to protect their customers and provide safe products Since 1 January there is also a law in the Netherlands that requires companies to report any data leaks. https://www.government.nl/latest/news/2015/07/10/obligation-to-report-data-leaks-and-cbp-power-to-impose-fines-in-effect-from-1-january-2016 https://www.government.nl/latest/news/2015/07/10/obligation-...
  - rogeryu 11y ago
    A data leak is not the same as a security vulnerability. The data leaks refer to organisations having customer data which is hacked. They have to report this. This doesn't cover finding a leak in Flash.
- gaius 11y ago
  Withholding known security vulnerabilities from the public in order to be later used for hacking is immoral and dangerous. I was thinking about this when Anonymous "hacked" thousands of ISIS twitter accounts. On the one hand that saves Twitter from having to make a stand themselves - but if they didn't immediately plug those holes, they're leaving legitimate users at risk.

by SCHiM 11y ago

nitrogen 11y ago

If such a thing is allowed, then higher standards should be applied to forced digital entry by police than are applied to forced physical entry. Also, one very bothersome side effect of government-sanctioned hacking is that governments have an incentive not to notify software vendors about vulnerabilities.

belorn 11y ago

Withholding known security vulnerabilities from the public in order to be later used for hacking is immoral and dangerous. Imagine if the police had prior knowledge of a vulnerability in the computer system of a car, but did not act to protect the public. A few years later a criminal figure out the same vulnerability and causes a major car crash on a motorway and murder several people. I would view the police officer to be found liable under breach of duty, same as if they witnessed a crime and refused to act. Under the same logic, if companies has a legal responsibility to protect their customers and provide safe products, and police officers has a professional responsibility to report crimes, then the police should be forced to act if they have confirmed information about a security vulnerability.

cornedor 11y ago
> if companies has a legal responsibility to protect their customers and provide safe products Since 1 January there is also a law in the Netherlands that requires companies to report any data leaks. https://www.government.nl/latest/news/2015/07/10/obligation-to-report-data-leaks-and-cbp-power-to-impose-fines-in-effect-from-1-january-2016 https://www.government.nl/latest/news/2015/07/10/obligation-...
- rogeryu 11y ago
  A data leak is not the same as a security vulnerability. The data leaks refer to organisations having customer data which is hacked. They have to report this. This doesn't cover finding a leak in Flash.
gaius 11y ago
Withholding known security vulnerabilities from the public in order to be later used for hacking is immoral and dangerous. I was thinking about this when Anonymous "hacked" thousands of ISIS twitter accounts. On the one hand that saves Twitter from having to make a stand themselves - but if they didn't immediately plug those holes, they're leaving legitimate users at risk.