5 ms·
Belgium legalises ethical hacking
- jruohonen 4y agoSome progress but with some notable weaknesses (a state institution determines whether public disclosure is appropriate).
- Barrin92 4y agoSeems more than reasonable given that the law does not appear to exclude state institutions from being the target of hacking. If that provision did not exist you can bet the law would never apply to any security sensitive sector.
- meinheld111 4y ago> If that provision did not exist you can bet the law would never apply to any security sensitive sector. „Oh yeah, he is very sensitive in this regard. Please don’t Talk to him about his insecurities“
- tommiegannert 4y ago> The new Belgian whistleblower law (Klokkenluiderswet) has changed the legal situation for ethical hacking in Belgium. A natural or legal person is now authorised to investigate organisations in Belgium for potential cybersecurity vulnerabilities, even if they have not consented to such investigations. Cool. Though, Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there. This will be fascinating to follow. > The second condition mandates that ethical hackers report any uncovered cybersecurity vulnerability as soon as possible to the Centre for Cyber Security Belgium (CCB), which is the national computer security incident response team of Belgium. I really hope they will take the opportunity and publish statistics about the reports. > The final condition is an obligation for ethical hackers to not disclose information about the uncovered vulnerability to a broader public without the consent of the CCB. Right, I agree with OPs comment, that this is a bummer. Why not let the organization self decide this? Or one-out-of-two? This seems a bit fishy. I hope it works out.
- andreareina 4y agoThe context here is "without authorisation of the owner of the system"; if they agree to publication then the additional protections [need to] don't apply
- crimsontech 4y agoIt’s going to be interesting in the cases where the security researchers cause denial of service conditions, data corruption, or just weaken or breaks a security control totally leaving systems and data wide open.
- michaelt 4y ago> Though, Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there. I doubt it'll deter anyone from running computer systems. After all, hacking already goes unpunished if it crosses the right jurisdictional borders, or if the attacker can't be traced. And for most attacks both are true so the cops don't do anything. The only difference this law makes is for in-country hackers who disclose their own identity.
- sillysaurusx 4y agoGood. Make it law in every other country too. You would not believe the amount of duct tape holding systems together; crowd sourcing the inspections would at least get eyeballs on the problems, even if it caused an uptick in security incidents. (Former pentester @matasano, though only for a little over a year.) After witnessing the results of over 50 pentests, you’re dragged to the conclusion that (a) companies usually get pentests because they’re forced to by other companies, and (b) the security incidents that do happen tend not to affect the companies themselves. By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. The cost is borne by the customers whose data is exposed, not the companies who allowed the breach. De-legislating cybersecurity will improve security, almost by definition. As you say, you’re forced to secure your systems. This is probably a net positive, and hopefully the experiment in Belgium will show why.
- derefr 4y agoDoes this mean anything for the legal protections of Belgian citizens who research security vulnerabilities in foreign, rather than domestic, systems?
- janosdebugs 4y agoNo: > The new Belgian whistleblower law only applies in Belgium. If a cybersecurity vulnerability concerns an IT system outside of Belgium, hacking might be covered by the rules of the country where the system is located.
- bmacho 4y agoThat part is obvious, if you commit a crime somewhere else, then you commit it somewhere else. The question is whether Belgium protects you as their citizen, or doesn't.
- sgjohnson 4y agoTypically extradition requires dual criminality. i.e. you can’t be extradited for something that is a crime in a foreign country but isn’t in yours.
- nomercy400 4y agoAny cloud datacenters in Belgium?
- andruby 4y agoGoogle has a large datacenter there. (europe-west1)
- IMTDb 4y agoeu-west-1 is in Ireland. There are no currently open availability zone in Belgium. Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-re...
- deleted 4y ago[deleted]
- trompetenaccoun 4y agoI guess the people cheering this have not lived in Europe. Typically what happens is that some of the local hackers who naively trust the state and disclose their hacks will have the book thrown at them. Either on the basis of an inconsequential technicality or because authorities arbitrarily decide the hack intended to cause harm or was not "proportionate", enabled by the vague wording of the law. Meanwhile the actual criminals who mostly aren't located in the EU to begin with get off scot-free, even if they can be tracked back to Russia or somewhere local law enforcement can do nothing about it in the majority of cases.
- sph 4y agoI live in Europe and I don't know many if any story of ethical hackers getting incarcerated. In my youth in Italy, when I dabbled in "hacking", the stories going around at the time on IRC were that if you were ever nabbed hacking a server, you would get recruited by the local cyber police force (Polizia Postale)
- guerby 4y agoFrench hacktivist bluetouff was condemned for finding and reporting that government files were left unprotected on the internet: https://www.silicon.fr/bluetouff-blogueur-condamne-recherche-google-92584.html https://www.silicon.fr/bluetouff-blogueur-condamne-recherche... 30 hours locked up in the police station, all equipment confiscated.
- mr_mitm 4y agoGerman hacktivist Lilith Wittmann was charged for responsibly disclosing a vulnerability in a server of a political party, but charges were dropped after a public outcry.
- systemtest 4y agoI once reported a leak on a government website to the National Cyber Security Centre, hoping to get a cool t-shirt out of it ("I hacked the Dutch government and all I got was this lousy t-shirt"). Turns out that system wasn't government but contracted out to the private sector. That got me into a lot of trouble since I reported a leak on a private company. Luckily I didn't get arrested or sued after explaining my intentions. I have since not disclosed anything I find. Too much of a risk.
- BiteCode_dev 4y agoI'm divided on this one. On one hand, I can see a lot of good in this, because, well, I'm on HN. On the other hand, I think people would find it weird that anybody would be allowed to do that IRL with physical building, so why allow it on the internet? Given that the consequences of probing a website are less than cracking on an office, and the surface of attack bigger on a website, with potentially a larger cascade, I think I can find more arguments for than against. But it's not so easy to answer.
- risyachka 4y agoLike with physical business, if you can't guarantee proper security - you should not be in this business. Companies cut costs on cyber security whenever they can. And if you try to expose it you can get sued. It's about time this ends. Hopefully everywhere soon.
- BiteCode_dev 4y agoThere are millions of small businesses that have an online presence and no way to protect themselves against a physical building penetration. Heck, most administrations can't. A small town city council cannot be expected to have the budget or expertise to deal with someone trying to break in.
- karaterobot 4y ago> Like with physical business, if you can't guarantee proper security - you should not be in this business. What's an example of a business that can guarantee proper physical or computer security? I can't think of any. All I know about managing security is that you first acknowledge that you can't ever be completely safe. I'll assume you mean they guarantee that they have done due diligence to reduce their threat profile — which isn't really saying much either.
- mindslight 4y agoThe physical world and the Internet are completely different environments, and analogies don't transfer. In the physical world attackers are resource constrained, create evidence that allows for attribution, post-facto enforcement is mostly successful, attacks are mostly destructive, and security can only ever be "good enough" bar. Meanwhile in the electronic word, many attacks can be easily scaled/automated so they're always happening, attribution is very hard, there's little post-facto enforcement especially across borders, most attacks don't do much damage in and of themselves, and most security problems are logic bugs which are yes/no affairs. It's not particularly interesting if a "white hat" physical attacker demonstrated they could get into a safe with a drill over the course of a week. And one probably can walk down a street testing businesses' doors after hours without too many repercussions if you're dressed nice and don't fit the cops' stereotype of "criminal". Also there's a huge tendency in the digital security world for system owners to play up damages from minor break ins or even mostly innocuous actions (eg port scans), to distract from the humiliation of themselves having failed. And if we did want to make punishment more in line with real world analogs, then the penalty for most unauthorized accesses should be akin to misdemeanor trespassing.
- victorvosk 4y agoI know everyone is high fiving but this like most Euro tech laws, is so obscenely murky and essentially opens the flood gates on anyone running servers over there.
- kriro 4y ago"""The new Belgian whistleblower law only applies in Belgium.""" I haven't read the PDF of the law but from the article it doesn't sound like it is limited to Belgian citizen but only to the location. I hope there will be some pressure on the government organization to basically rubber stamp the "disclosure allowed" authorization in a reasonable time if everything was reported to them but remain a bit sceptical. Quite curious on the implications for the announced eu-west-3-bru-1a (AWS Brussels). I hope Amazon won't cancel it :)
- vrglvrglvrgl 4y ago[dead]
- stainablesteel 4y agoI've wanted this for the longest time. It makes a lot of sense because any existing vulnerabilities are ALREADY vulnerabilities. If exploited they're only going to go to whatever bad actors are trying to be secretive. If you incentivize people [and young kids] to try hacking into their local government/company infrastructure by offering a reward in exchange or an explanation, you're basically making a cybersecurity immune system for your entire country. When chinese/north korean/russian hackers are savagely going after hospital infrastructure and trade secrets in western countries, this is the best step forward towards improving the upstream and training your own hackers in response to these kind of events.
- tough 4y agoI don't really know, more like a guess: Norway, Denmark, Finland, and Sweden.
- mintu123adak 4y ago[flagged]
- mintu123adak 4y ago[flagged]
- justinclift 4y agoHeh, wonder which hosting operations have data centres in Belgium? Sounds like they'll be getting some new customers setting up proxy software. ;) "The hackers are coming from inside Belgium, we can't do anything!"