4 ms·

I'm amazed and slightly confused at the idea that the act of writing a piece of software can in and of itself be illegal. Do the laws require distribution or s

I'm amazed and slightly confused at the idea that the act of writing a piece of software can in and of itself be illegal. Do the laws require distribution or showing of intent to harm or simply writing malware? Is there any precedent to democracies jailing a person over reducing to writing an idea or algorithm?

brians 9y ago
Writing even this software wouldn’t have been illegal. It’s mentioned in the indictment as a concrete act in furtherance of a conspiracy, part of the technical abstraction of prosecuting a conspiracy in US law. What is illegal is stealing from banks, and conspiring to steal from banks—and so they’ll show communication, an illegal agreement, and concrete acts in support of the conspiracy. If they weren’t pretty sure they could persuade a jury of those, they wouldn’t have gotten this far. There are also some devices it’s illegal to build—bombs, for example, and other devices whose only or nearly-only purpose is illegal. Some software is included there, including software whose only purpose is illegal wiretapping. That makes it legal to write and exchange proofs of concept for vulnerabilities, but you have to be really careful not to make the PoC too pointy.
- kbwt 9y ago
  In Germany, even the act of writing[1] software whose purpose is to access data without authorization[2] or intercept data transmissions intended for someone else[3] is a felony. [1] https://dejure.org/gesetze/StGB/202c.html https://dejure.org/gesetze/StGB/202c.html [2] https://dejure.org/gesetze/StGB/202a.html https://dejure.org/gesetze/StGB/202a.html [3] https://dejure.org/gesetze/StGB/202b.html https://dejure.org/gesetze/StGB/202b.html
  - ship_it 9y ago
    Where do you draw a line between a "remote file manager" and "software whose purpose is to access data without authorization"?
    - justinclift 9y ago
      The "without authorization" bit?
cm2187 9y ago
Well, that's the "it's not guns that kill, it's the people who use them" argument. Which I have some sympathy for. But many disagree.
- wvh 9y ago
  Except that a handgun's primary purpose is just that; it's a pretty blunt tool. But software can have many purposes, even if it is security related: research, practice, proof-of-concept, curiosity, ... We better hope they have some real evidence beyond just some random code; if mere possession is enough, they can throw all of us security people in jail, together with anybody who has any DRM circumvention or file-sharing software and whatnot. Seems any computer could contain something to detain just about anybody if twisted around enough. I guess only the future will bring clarity if this is gross overreach or if they really have substantial evidence that he is both the source and had the intent.
  - talmand 9y ago
    A gun's primary purpose is not to kill a human being by default. A gun is designed to fire bullets, the bullet is designed to inflict intended levels of damage upon the target of choice. A single gun can have ammunition that ranges from no damage whatsoever to any target up to beyond lethal to a living target. In other words, your gun's primary purpose is what you decide it is.
- shallot_router 9y ago
  What about someone who manufactures guns and knowingly sells them to street gangs without registering them? That's closer to what Hutchins is alleged to have done.
strictnein 9y ago
No, writing the code is not illegal. Code is speech in the US. Using the code to commit illegal acts is the issue.
- gameshot911 9y ago
  Interesting - can you source any doctrine or case law that explicitly states that 'code is speech'?
  - strictnein 9y ago
    https://www.eff.org/deeplinks/2015/04/remembering-case-established-code-speech https://www.eff.org/deeplinks/2015/04/remembering-case-estab...
dabber 9y ago
The Washington post has an article[1] talking about this. It looks like the FBI did some digging to come up with the charges. Counts 2 through 4 are related to violations of 18 U.S.C. 2512 [2] which criminalizes making, selling, or advertising for sale illegal wiretapping devices. That's pretty interesting because as far as I know it would be a first to categorize malware as such a "device". [1] https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/08/03/the-kronos-indictment-it-a-crime-to-create-and-sell-malware/?utm_term=.2919e879c153 https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... [2] https://www.law.cornell.edu/uscode/text/18/2512 https://www.law.cornell.edu/uscode/text/18/2512
deleted 9y ago
[deleted]
chmike 9y ago
What is also amazing is that the American activity and responsibility in this mess is unpunished. Objectively, the victims of WannaCry should trial America and request a repair. While I do appreciate and support the backpressure on illegal activities on the internet to make it a safe place, it should also apply to state activity.

brians 9y ago

Writing even this software wouldn’t have been illegal. It’s mentioned in the indictment as a concrete act in furtherance of a conspiracy, part of the technical abstraction of prosecuting a conspiracy in US law. What is illegal is stealing from banks, and conspiring to steal from banks—and so they’ll show communication, an illegal agreement, and concrete acts in support of the conspiracy. If they weren’t pretty sure they could persuade a jury of those, they wouldn’t have gotten this far. There are also some devices it’s illegal to build—bombs, for example, and other devices whose only or nearly-only purpose is illegal. Some software is included there, including software whose only purpose is illegal wiretapping. That makes it legal to write and exchange proofs of concept for vulnerabilities, but you have to be really careful not to make the PoC too pointy.

kbwt 9y ago
In Germany, even the act of writing[1] software whose purpose is to access data without authorization[2] or intercept data transmissions intended for someone else[3] is a felony. [1] https://dejure.org/gesetze/StGB/202c.html https://dejure.org/gesetze/StGB/202c.html [2] https://dejure.org/gesetze/StGB/202a.html https://dejure.org/gesetze/StGB/202a.html [3] https://dejure.org/gesetze/StGB/202b.html https://dejure.org/gesetze/StGB/202b.html
- ship_it 9y ago
  Where do you draw a line between a "remote file manager" and "software whose purpose is to access data without authorization"?
  - justinclift 9y ago
    The "without authorization" bit?

cm2187 9y ago

Well, that's the "it's not guns that kill, it's the people who use them" argument. Which I have some sympathy for. But many disagree.

wvh 9y ago
Except that a handgun's primary purpose is just that; it's a pretty blunt tool. But software can have many purposes, even if it is security related: research, practice, proof-of-concept, curiosity, ... We better hope they have some real evidence beyond just some random code; if mere possession is enough, they can throw all of us security people in jail, together with anybody who has any DRM circumvention or file-sharing software and whatnot. Seems any computer could contain something to detain just about anybody if twisted around enough. I guess only the future will bring clarity if this is gross overreach or if they really have substantial evidence that he is both the source and had the intent.
- talmand 9y ago
  A gun's primary purpose is not to kill a human being by default. A gun is designed to fire bullets, the bullet is designed to inflict intended levels of damage upon the target of choice. A single gun can have ammunition that ranges from no damage whatsoever to any target up to beyond lethal to a living target. In other words, your gun's primary purpose is what you decide it is.
shallot_router 9y ago
What about someone who manufactures guns and knowingly sells them to street gangs without registering them? That's closer to what Hutchins is alleged to have done.

strictnein 9y ago

No, writing the code is not illegal. Code is speech in the US. Using the code to commit illegal acts is the issue.

gameshot911 9y ago
Interesting - can you source any doctrine or case law that explicitly states that 'code is speech'?
- strictnein 9y ago
  https://www.eff.org/deeplinks/2015/04/remembering-case-established-code-speech https://www.eff.org/deeplinks/2015/04/remembering-case-estab...

dabber 9y ago

The Washington post has an article[1] talking about this. It looks like the FBI did some digging to come up with the charges. Counts 2 through 4 are related to violations of 18 U.S.C. 2512 [2] which criminalizes making, selling, or advertising for sale illegal wiretapping devices. That's pretty interesting because as far as I know it would be a first to categorize malware as such a "device". [1] https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/08/03/the-kronos-indictment-it-a-crime-to-create-and-sell-malware/?utm_term=.2919e879c153 https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... [2] https://www.law.cornell.edu/uscode/text/18/2512 https://www.law.cornell.edu/uscode/text/18/2512

deleted 9y ago

[deleted]

chmike 9y ago

What is also amazing is that the American activity and responsibility in this mess is unpunished. Objectively, the victims of WannaCry should trial America and request a repair. While I do appreciate and support the backpressure on illegal activities on the internet to make it a safe place, it should also apply to state activity.