3 ms·

I'm also worried by these stories. However, I don't see any hope that malware exports will be curbed ahead of conventional weapons exports. Ultimately, weapons

by netcan 6y ago

I'm also worried by these stories. However, I don't see any hope that malware exports will be curbed ahead of conventional weapons exports. Ultimately, weapons can be exported under pretty liberal rules. Even if there are controls (like there are on weapons), the existence of a robust weapons market means that weapons are usually available to any regime (or less) that can pay for it. Certain weapons (ICBMs, tanks, jets) are actually controlled, but these tend to be weapons (1) without a robust market (2) that potentially challenge an exporters military power (3) really expensive. The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. We're losing at this.

luckylion 6y ago
> The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. That's hard to do though. Germany has their attempt with the infamous laws around "hacker tools", which place a lot of legal insecurity on any serious security work. "Rouge malware vendors" would already be operating illegally, and a state sanctioned developer that provides the state with malware can't be considered a mercenary, I think. I'm not convinced regular law enforcement badly needs malware to investigate, but I also don't see why they'd not get that tool (with court orders and solid procedures) if we allow them to do other kinds of surveillance. From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.
- netcan 6y ago
  >>* From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.* There is a danger that comes from thinking of these problems as theoretical. They aren't. We have a history, a present. History (germany knows this more than most) is that a surveillance-centric law enforcement is the basis for a repressive regime. The stasi wasn't a coincidence. The present shows us that state surveillance is on the rise. Again germany makes a fine example. Already repressive regimes (like Belarus, currently) give us an easier to grok understanding of the mechanics. It's easy for us to agree that it's bad to supply these to bad regimes. If Lukashenko uses german software operated by german mercenaries (I believe this is a precise definition of the term) to find and arrest his dissenters, germans will feel that this company is bad. That's easy. But, that company can migrate and I doubt export bans would have denied Luka much or changed the game meaningfully in Belarus. It's effectively symbolic. What is more important is for germans to ban their own governments from doing this, or at least strictly restrict it to counter-terrorism. If any police department can hire mercenaries to "do cyber-policing," we get to stasi situations quickly. Unlimited power is a bad thing, a dangerous thing.

by netcan 6y ago

luckylion 6y ago

> The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. That's hard to do though. Germany has their attempt with the infamous laws around "hacker tools", which place a lot of legal insecurity on any serious security work. "Rouge malware vendors" would already be operating illegally, and a state sanctioned developer that provides the state with malware can't be considered a mercenary, I think. I'm not convinced regular law enforcement badly needs malware to investigate, but I also don't see why they'd not get that tool (with court orders and solid procedures) if we allow them to do other kinds of surveillance. From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.

netcan 6y ago
>>* From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.* There is a danger that comes from thinking of these problems as theoretical. They aren't. We have a history, a present. History (germany knows this more than most) is that a surveillance-centric law enforcement is the basis for a repressive regime. The stasi wasn't a coincidence. The present shows us that state surveillance is on the rise. Again germany makes a fine example. Already repressive regimes (like Belarus, currently) give us an easier to grok understanding of the mechanics. It's easy for us to agree that it's bad to supply these to bad regimes. If Lukashenko uses german software operated by german mercenaries (I believe this is a precise definition of the term) to find and arrest his dissenters, germans will feel that this company is bad. That's easy. But, that company can migrate and I doubt export bans would have denied Luka much or changed the game meaningfully in Belarus. It's effectively symbolic. What is more important is for germans to ban their own governments from doing this, or at least strictly restrict it to counter-terrorism. If any police department can hire mercenaries to "do cyber-policing," we get to stasi situations quickly. Unlimited power is a bad thing, a dangerous thing.