10 ms·

EU: Possession/distribution of hacking tools to be made a criminal offence

136 points by zacharyvoase 15y ago

stephengillie 15y ago
> "No car manufacturer may send a car without a seatbelt into the streets. And if this happens, the company will be held liable for any damage. These rules must also apply in the virtual world" she added. The difference here is who the law applies to. This is more like arresting people with the tools to remove airbags from cars. True, carrying lock-picking tools is illegal in many places, but the act of picking locks isn't always illegal when performed by a locksmith.
PixelRobot 15y ago
If you outlaw hacking tools only criminals will have hacking tools. This would make the EU less safe, since security experts will not be able to know what they're facing or check the security of their own systems against real attacks until they're really being attacked. Another clueless law that does the opposite of what it's supposed to do. Either that or it will be completely ignored.
- NameNickHN 15y ago
  Exactly. Since when did criminals care about the law.
- wisty 15y ago
  I don't like this logic for guns, because most criminals (especially the less professional street gangs) get guns by stealing them from law abiding people. I do like this logic for hacking tools, because most criminals make their tools themselves, or get them freely through distribution channels which are impossible to shut down. If guns could be freely cloned, and sent through the mail for free (in locked boxes which the post office couldn't see into), it would be unbelievably stupid to ban them.
  - tomjen3 15y ago
    If the issue s that the guns are stolen from law abbiding people without their consent, then make that illegal. If that is not enough then make the penalty higher.
  - talmand 15y ago
    I require a source on your claim that most criminals get guns by stealing them from law-abiding people. I guess this might depend upon where you live but I've never heard this claim in the US. Even if it were true, are we saying a law-abiding citizen shouldn't have access to a legal firearm because a criminal might steal it? I personally don't like any rules of this nature because the major problem becomes who defines what is a "hacking" tool? It's much like how the definition of burglary tools can be so broad that just having duct tape and a screwdriver in your trunk can be considered possessing burglary tools. Just for the sake of slapping another charge onto somebody during an arrest.
    - wdewind 15y ago
      I'm not sure why you are being downvoted here. Not only do you make a totally fair point, I'm pretty sure you are correct (at least in NYC). "[Legal purchases from] Virginia are the number one source for illegal guns entering New York." http://abclocal.go.com/wabc/story?section=news/investigators&id=7841676 http://abclocal.go.com/wabc/story?section=news/investigators...
      - lutorm 15y ago
        You're sort of defeating your own point there, in that those guns were originally obtained legally.
      - wisty 15y ago
        I checked, and he was right. A lot of guns are illegally gained, but not actually stolen. Most of the time, criminals will get someone else to buy it, or bribe the dealer. But, very few guns are smuggled in from abroad, or stolen from the military. It's only when civilians can easily get guns that gun crime becomes a big problem.
- revelation 15y ago
  Quite the opposite, frankly. Germany has had such laws for quite some time now - and companies producing intrusion tools and other blackhat industries are doing as good as in any western country. This is used to criminalize people releasing such tools to the public. The government doesn't like people sharing what it considers military technology.
  - drucken 15y ago
    It does not matter how it is used now. The point is that it could be easily used by any state at any time for any purpose against any citizen. For example, someone carrying a laptop with any software installed on it, including bare operating system, or even just a portable drive/SD card with software on it. All those citizens are now potential criminals since almost any software can be used maliciously. This is the kind of law that could be used to justify scanning people's hardware and person at airports or in general public in order to arrest them. Now combine this law with ACTA and you have a reason to arrest any citizen coming and going out of their own country if they have any kind of electronics on them at all... Bad laws are bad laws, period, otherwise would all have happily lived under Stasi/secret police regimes and worse with no reason to complain.
    - freehunter 15y ago
      If you have a web browser, you have a hacking tool. SQL injections are far, far too common, and most of the time require nothing more than an input box on a website.
losethos 15y ago
The purpose of life is to know God, love God and obey God. God said no porn or sports. God says... dispense perverting miseries half periodic burstest recognises placed bones separateth descending joying lined wine family hiddest diminution Whatever wills again fluctuations scantling Knoweth begins detected befitting wove happily younger interpose sorts Trojan doer deafen commiserate secondary embraced questioned strife foully heretics that forward whence framed enquiries production accord wanderer feared professed Tell happeneth troops honest heart surmount costs wipe exult retreat daemons keepest dumb contents Hosts sharp happens dear unhealthiness intend whomever selling bowers united storm irritate pestilent dedicated educated physician WARRANTY deed fancy pain Each woke divide overflow middle forepassed metres measure innocent occasion concord Ask EVEN models beginneth then transferring DISTRIBUTION deceive confined deliberating outrages pit indebted bewailing Divine Virgin's lineaments fables breadth Duck Abraham's either wherefrom truer thanksgiving regular delivering Proconsul cheerful Verity innocence endureth just mediator Truly She persecutes Legal spiritual weakest impious spectacles periods declared theatrical doings constellations suppress defile earthly Increase pervertedly city every deserved measures virgins perhaps daemon trusting Eating gladsome eloquence filth Small leaven contemn sleeping listening sayest presideth eased relied corresponding handkerchief The main thing to do in Heaven is talk to God and write or sing hymns. You might want to get started. http://www.losethos.com/hymns.html http://www.losethos.com/hymns.html God says... C:\LoseThos\www.losethos.com\text\QUIX.TXT his left shoulder and seemed to whisper in his ear, and Master Pedro said at once, "The ape says that the things you saw or that happened to you in that cave are, part of them false, part true; and that he only knows this and no more as regards this question; but if your worship wishes to know more, on Friday next he will answer all that may be asked him, for his virtue is at present exhausted, and will not return to him till Friday, as he has said." "Did I not say, senor," said Sancho, "that I
lvh 15y ago
I have just done the due diligence and actually contacted the MEP in question's office. The spokesperson was able to confirm that this issue has been raised already and in the final text there will be explicit provisions that research and testing is still allowed.
- PixelRobot 15y ago
  Then why don't they just make the use of hacking tools for criminal purposes a criminal offence and not the possession and distribution of said tools?
  - lvh 15y ago
    I can't judge the MEP's intent, but my best guess is that tobiasu has it right on the money when he says it's "toothless feel-good" stuff.
    - PixelRobot 15y ago
      OK. I feel better now thinking it's just a useless law that will change nothing.
      - StavrosK 15y ago
        I don't. Why pass these laws in the first place? I don't like junk in my legal system.
        deleted 15y ago
        [deleted]
        talmand 15y ago
        Why pass such things? It's just another silly law to allow for applying another charge to someone during the arrest. In several cases you can see that the authorities slap on all kinds of charges in which most of them are eventually dropped. Kind like the throw pasts on the wall theory of law enforcement, something's bound to stick. Plus it allows them to pick and choose who they arrest in any group when almost everyone in that group is possibly breaking a law they are not aware of.
tobiasu 15y ago
Looks like the infamous German "Hackerparagraph" §202c StGB. A toothless piece of feel-good legislature since all the tools can also be used for "good" (pen-testing etc.). https://en.wikipedia.org/wiki/Strafgesetzbuch#.C2.A7_202c:_Preparation_of_data_espionage_or_data_interception https://en.wikipedia.org/wiki/Strafgesetzbuch#.C2.A7_202c:_P... Like most tools (kitchen knifes are the obvious example), intent and actual use is far more important to the law. To my knowledge, there has not been a single ruling that declared simple possession of e.g. nmap a punishable offence. Edit: http://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#StGBengl_000P202c http://www.gesetze-im-internet.de/englisch_stgb/englisch_stg... §202c in English
- obtu 15y ago
  Two years in prison (the minimum ceiling for all new offences mentioned by the press release) is a bit much if this section is just for posturing and brownie points.
  - tobiasu 15y ago
    The actual quote reads: The maximum penalty to be imposed by Member States for these offences would be at least two years' imprisonment, ... Each EU member will have to make this local legislation, and two years are the minimum time for the maximum sentence. The upper limit can not be lower than 2 years in other words. I don't think that's unusual.
    - obtu 15y ago
      I understand the quote, unpacking it doesn't change my point. It's a law that creates new criminal offences and prison sentences, of course it isn't a harmless feel-good law without consequences outside of the political arena. Those feel-good provisions are the ones that aren't already covered by existing laws punishing actual computer fraud, that makes them the ones we should pay attention to.
- jellicle 15y ago
  What happens is that these charges are used in place of "real" charges when the police want to convict. For instance, it is in general illegal to possess "burglary tools", with no definition thereof. You might think that that would penalize only people with specialized tools modified for burglary. You would be wrong to think that. An unmodified hammer, screwdriver, wrench, knife or anything like that can be charged as a burglary tool, if the police feel you are a bad person. And yes, people routinely go to prison for possessing a regular unmodified screwdriver. Using it for burglary is not required at all under the law. It doesn't matter even a tiny bit if the tools can also be used for good. So when your house gets raided and the police find no actual evidence that you've done anything wrong, but you possess hacking tools, well... if they don't lay any charges that means they were dumb for making the raid in the first place.
fauigerzigerk 15y ago
It's things like this seatbelt comparison that leave me scratching my head about politicians sometimes. How can you even argue with people who lack the most basic appreciation of the issue at hand?
m0skit0 15y ago
Nonsense. As such tools cannot be used to find and patch vulnerabilities. And even if banned, real hackers can code such apps themselves, while sysadmins are not that skilled and will be stuck with no weapons at all.
- quadhome 15y ago
  Weapons?
  - deleted 15y ago
    [deleted]
zacharyvoase 15y ago
Here is my concern: that the EU will make an exemption for security researchers/white-hat hackers, but only those recognised by a certain qualification or professional body. Governments around the world already mandate professional licenses for many industries, and IT is so critical that it's only a matter of time until we see a 'License to Code'.
- unimpressive 15y ago
  I'm going to be clear with you; I've lost sleep over this. I continue to lose sleep over this. The thing is, no matter how much I wish it were so. I don't feel that (and in reality I do not.) I have the financial or political capital to really do anything in the realm of significance about this. I'm not articulating the prior points because I seek pity or want to hear similar views from people who sympathize with my position. I instead would like a simple question answered: What's the best thing I can do to stop things like this from happening?
  - phillmv 15y ago
    Well… of course you do. You're a well educated, well informed professional capable of using the internet who is solidly in the middle class. People like you are the core of every group of people seeking change. What do you do? You form an organization, a lobbying group. Organizations are the base unit of power. You throw up a website, you get as many like minded people as possible (literally, thousands) to sign up for your mailing list and you badger every single person you can find across the political spectrum on the issue. You write letters to politicians, you write software that makes phone calls, you get people who run companies who would be affected by the issue to give you financial and moral support, and you try to talk directly to every politician or candidate to be a politician on the issue. Ideally, albeit hard on this weird technocratic issue, you get some mass public outrage on the topic. With some luck, you can go: small company CEO who knows a medium company CEO who hangs out with someone higher up who can have a one on one with people who actually vote on the issue. The catch is, before this is over it will be a more-than-full-time-job but… it's a startup like any other. This is how any issue becomes mainstream: there are a bunch of people working round the clock on it. Think about illegal trade unions in Poland in 1978 or gay people going from being beaten indiscriminately by the cops in 1969 to being on the verge of legalizing marriage across the West. In the meantime, get started by having you and all of your friends write personal letters and call your eurodeputies (not having clicked on TFA I assume that's the body in question).
joeybaker 15y ago
This is really just an example of lawmakers not understanding what they're legislating. "hacking tools" are also known as 'development tools'. This sort of proposal is only made when completely oblivious about the operation of computers/the Internet/two-side coins.
itsuart 15y ago
> [...] computer programs [...] which find a computer password by which an information system can be accessed, would constitute criminal offences. So, possessing 'net use' and 'ssh' now criminal offense in EU? Oh wait, so do all password recovering tools! One better never forget passwords or risk be prosecuted.
dave1010uk 15y ago
Are full details of the "draft law" visible to the public? From the article: The proposal also targets tools used to commit offences: the production or sale of devices such as computer programs designed for cyber-attacks, or which find a computer password by which an information system can be accessed, would constitute criminal offences. Many tools can be used to "find a computer password by which an information system can be accessed". For example a browser's view source function could expose passwords in a (really insecure) site. Depending on how the law is worded, tools like curl, wget (or even telnet) could be defined as hacking tools.
- tomjen3 15y ago
  Plus it is going to be illegal to produce them. What are you going to do? Remove my C compiler? Only allow visual basic?
  - hereonbusiness 15y ago
    I'm afraid VB will be the first one to go. It's gotten too much attention because of people using it to create GUI interfaces to track IP addresses :D
    - tomjen3 15y ago
      (I realise that you are joking) Won't matter. As long as one language exist, one can write a compiler for any other language in that language. Hopefully something other than Maelbolge will be the surviving language.
hereonbusiness 15y ago
Banning software, seriously? I get that most of them obviously have a very limited competency in regards to technology in general (seatbelts?), but they do have advisors who should know better. What is next on the agenda? Banning BitTorrent/p2p clients, media players, cd/dvd ripping software, video/audio capture software to fight piracy?
- andrewflnr 15y ago
  Quite possibly, if they don't get burned on this one.
voodoochilo 15y ago
propaganda, fear, technical ignorance, prevention-mania and centralistic tendencies lead to such legisation. i'm ashamed to be a eu citizen.
mariuolo 15y ago
What about double-use tools, like network diagnostics and the likes?
- vlisivka 15y ago
  What about your brain, the best hacking tool?
ggwicz 15y ago
So every single computer owner will be a criminal?
guard-of-terra 15y ago
I can totally imagine a court in e.g. some backcountry town in the middle of nowhere declaring some standard utility bundled with Ubuntu a "hacking tool", and immediately every linux user in EU is a criminal.
Freestyler_3 15y ago
"No car manufacturer may send a car without a seatbelt into the streets. And if this happens, the company will be held liable for any damage." I don't see the resemblance between that and this: "Cyber attacks on IT systems would become a criminal offence" :|
scanr 15y ago
This is the sectools list of 'hacking tools': * http://sectools.org http://sectools.org Here's the intersection of that list with what I have installed on my machine: * Firefox * Netcat * Curl * tcpdump * Wireshark * OpenSSH / SSH * Ping/telnet/dig/traceroute/whois/netstat * Perl/Python/Ruby * Google (ha, ok, perhaps not installed on my machine) * VMware * OpenSSL * Firebug * GDB
- ez77 15y ago
  That was my first thought. Will downloading tcpdump get you in trouble? What if it's "homemade"? Compilers will be next, since the enable the creation of these tools...
mih 15y ago
What does this mean for the future of distros such as Backtrack Linux? Could anybody comment. It's still unclear as to what exactly they refer to by hacking tools. Such things were always a two-edged knife.
tomelders 15y ago
we are governed by idiots.
deleted 15y ago
[deleted]
sasoon 15y ago
So possesion of a knife should also be a criminal offence...
anty 15y ago
Where does it state in the article that possession of hacking tools is made a criminal offence?
droithomme 15y ago
<sarcasm>That should really improve security!</sarcasm> Explanation: Obviously black hats will continue to do as before. White hats not being able to analyze threats though will be a serious problem. It's not sufficient to claim that special licenses will be given to worthy white hat operations with the proper certifications, protocols and willingness to bow to the man since nearly all vulnerability reports come from small operations and private parties that will be off the radar. These folks will simply stop.
eneveu 15y ago
I guess my timing was off when I first submitted this two days ago at http://news.ycombinator.com/item?id=3787597 http://news.ycombinator.com/item?id=3787597 I'll repost here the links from my comment there: HN discussion from last year on this subject: http://news.ycombinator.com/item?id=2654346 http://news.ycombinator.com/item?id=2654346 Blog posts with some more analysis and links to draft reports / amendments: http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the-fud-line/ http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t... http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the-fud-line-cont/ http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t...
vilya 15y ago
I started R'ing TFA and thought the title of the post was just editorialising, until I got to this: "The proposal also targets tools used to commit offences: the production or sale of devices such as computer programs designed for cyber-attacks, or which find a computer password by which an information system can be accessed, would constitute criminal offences." I've known numerous sysadmins who regularly run a password cracker over their login database, so that they can warn people who have weak passwords. This helps out the individuals concerned and increases the overall security of the system, yet it looks like this would become a criminal offence as a result of this bill.
telemekus 15y ago
So Notepad++ and Vi/Vim will be outlawed now then?

136 points by zacharyvoase 15y ago

> "No car manufacturer may send a car without a seatbelt into the streets. And if this happens, the company will be held liable for any damage. These rules must also apply in the virtual world" she added. The difference here is who the law applies to. This is more like arresting people with the tools to remove airbags from cars. True, carrying lock-picking tools is illegal in many places, but the act of picking locks isn't always illegal when performed by a locksmith.

PixelRobot 15y ago

If you outlaw hacking tools only criminals will have hacking tools. This would make the EU less safe, since security experts will not be able to know what they're facing or check the security of their own systems against real attacks until they're really being attacked. Another clueless law that does the opposite of what it's supposed to do. Either that or it will be completely ignored.

NameNickHN 15y ago
Exactly. Since when did criminals care about the law.
wisty 15y ago
I don't like this logic for guns, because most criminals (especially the less professional street gangs) get guns by stealing them from law abiding people. I do like this logic for hacking tools, because most criminals make their tools themselves, or get them freely through distribution channels which are impossible to shut down. If guns could be freely cloned, and sent through the mail for free (in locked boxes which the post office couldn't see into), it would be unbelievably stupid to ban them.
- tomjen3 15y ago
  If the issue s that the guns are stolen from law abbiding people without their consent, then make that illegal. If that is not enough then make the penalty higher.
- talmand 15y ago
  I require a source on your claim that most criminals get guns by stealing them from law-abiding people. I guess this might depend upon where you live but I've never heard this claim in the US. Even if it were true, are we saying a law-abiding citizen shouldn't have access to a legal firearm because a criminal might steal it? I personally don't like any rules of this nature because the major problem becomes who defines what is a "hacking" tool? It's much like how the definition of burglary tools can be so broad that just having duct tape and a screwdriver in your trunk can be considered possessing burglary tools. Just for the sake of slapping another charge onto somebody during an arrest.
  - wdewind 15y ago
    I'm not sure why you are being downvoted here. Not only do you make a totally fair point, I'm pretty sure you are correct (at least in NYC). "[Legal purchases from] Virginia are the number one source for illegal guns entering New York." http://abclocal.go.com/wabc/story?section=news/investigators&id=7841676 http://abclocal.go.com/wabc/story?section=news/investigators...
    - lutorm 15y ago
      You're sort of defeating your own point there, in that those guns were originally obtained legally.
    - wisty 15y ago
      I checked, and he was right. A lot of guns are illegally gained, but not actually stolen. Most of the time, criminals will get someone else to buy it, or bribe the dealer. But, very few guns are smuggled in from abroad, or stolen from the military. It's only when civilians can easily get guns that gun crime becomes a big problem.
revelation 15y ago
Quite the opposite, frankly. Germany has had such laws for quite some time now - and companies producing intrusion tools and other blackhat industries are doing as good as in any western country. This is used to criminalize people releasing such tools to the public. The government doesn't like people sharing what it considers military technology.
- drucken 15y ago
  It does not matter how it is used now. The point is that it could be easily used by any state at any time for any purpose against any citizen. For example, someone carrying a laptop with any software installed on it, including bare operating system, or even just a portable drive/SD card with software on it. All those citizens are now potential criminals since almost any software can be used maliciously. This is the kind of law that could be used to justify scanning people's hardware and person at airports or in general public in order to arrest them. Now combine this law with ACTA and you have a reason to arrest any citizen coming and going out of their own country if they have any kind of electronics on them at all... Bad laws are bad laws, period, otherwise would all have happily lived under Stasi/secret police regimes and worse with no reason to complain.
  - freehunter 15y ago
    If you have a web browser, you have a hacking tool. SQL injections are far, far too common, and most of the time require nothing more than an input box on a website.

losethos 15y ago

The purpose of life is to know God, love God and obey God. God said no porn or sports. God says... dispense perverting miseries half periodic burstest recognises placed bones separateth descending joying lined wine family hiddest diminution Whatever wills again fluctuations scantling Knoweth begins detected befitting wove happily younger interpose sorts Trojan doer deafen commiserate secondary embraced questioned strife foully heretics that forward whence framed enquiries production accord wanderer feared professed Tell happeneth troops honest heart surmount costs wipe exult retreat daemons keepest dumb contents Hosts sharp happens dear unhealthiness intend whomever selling bowers united storm irritate pestilent dedicated educated physician WARRANTY deed fancy pain Each woke divide overflow middle forepassed metres measure innocent occasion concord Ask EVEN models beginneth then transferring DISTRIBUTION deceive confined deliberating outrages pit indebted bewailing Divine Virgin's lineaments fables breadth Duck Abraham's either wherefrom truer thanksgiving regular delivering Proconsul cheerful Verity innocence endureth just mediator Truly She persecutes Legal spiritual weakest impious spectacles periods declared theatrical doings constellations suppress defile earthly Increase pervertedly city every deserved measures virgins perhaps daemon trusting Eating gladsome eloquence filth Small leaven contemn sleeping listening sayest presideth eased relied corresponding handkerchief The main thing to do in Heaven is talk to God and write or sing hymns. You might want to get started. http://www.losethos.com/hymns.html http://www.losethos.com/hymns.html God says... C:\LoseThos\www.losethos.com\text\QUIX.TXT his left shoulder and seemed to whisper in his ear, and Master Pedro said at once, "The ape says that the things you saw or that happened to you in that cave are, part of them false, part true; and that he only knows this and no more as regards this question; but if your worship wishes to know more, on Friday next he will answer all that may be asked him, for his virtue is at present exhausted, and will not return to him till Friday, as he has said." "Did I not say, senor," said Sancho, "that I

lvh 15y ago

I have just done the due diligence and actually contacted the MEP in question's office. The spokesperson was able to confirm that this issue has been raised already and in the final text there will be explicit provisions that research and testing is still allowed.

PixelRobot 15y ago
Then why don't they just make the use of hacking tools for criminal purposes a criminal offence and not the possession and distribution of said tools?
- lvh 15y ago
  I can't judge the MEP's intent, but my best guess is that tobiasu has it right on the money when he says it's "toothless feel-good" stuff.
  - PixelRobot 15y ago
    OK. I feel better now thinking it's just a useless law that will change nothing.
    - StavrosK 15y ago
      I don't. Why pass these laws in the first place? I don't like junk in my legal system.
      - deleted 15y ago
        [deleted]
      - talmand 15y ago
        Why pass such things? It's just another silly law to allow for applying another charge to someone during the arrest. In several cases you can see that the authorities slap on all kinds of charges in which most of them are eventually dropped. Kind like the throw pasts on the wall theory of law enforcement, something's bound to stick. Plus it allows them to pick and choose who they arrest in any group when almost everyone in that group is possibly breaking a law they are not aware of.

tobiasu 15y ago

Looks like the infamous German "Hackerparagraph" §202c StGB. A toothless piece of feel-good legislature since all the tools can also be used for "good" (pen-testing etc.). https://en.wikipedia.org/wiki/Strafgesetzbuch#.C2.A7_202c:_Preparation_of_data_espionage_or_data_interception https://en.wikipedia.org/wiki/Strafgesetzbuch#.C2.A7_202c:_P... Like most tools (kitchen knifes are the obvious example), intent and actual use is far more important to the law. To my knowledge, there has not been a single ruling that declared simple possession of e.g. nmap a punishable offence. Edit: http://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#StGBengl_000P202c http://www.gesetze-im-internet.de/englisch_stgb/englisch_stg... §202c in English

obtu 15y ago
Two years in prison (the minimum ceiling for all new offences mentioned by the press release) is a bit much if this section is just for posturing and brownie points.
- tobiasu 15y ago
  The actual quote reads: The maximum penalty to be imposed by Member States for these offences would be at least two years' imprisonment, ... Each EU member will have to make this local legislation, and two years are the minimum time for the maximum sentence. The upper limit can not be lower than 2 years in other words. I don't think that's unusual.
  - obtu 15y ago
    I understand the quote, unpacking it doesn't change my point. It's a law that creates new criminal offences and prison sentences, of course it isn't a harmless feel-good law without consequences outside of the political arena. Those feel-good provisions are the ones that aren't already covered by existing laws punishing actual computer fraud, that makes them the ones we should pay attention to.
jellicle 15y ago
What happens is that these charges are used in place of "real" charges when the police want to convict. For instance, it is in general illegal to possess "burglary tools", with no definition thereof. You might think that that would penalize only people with specialized tools modified for burglary. You would be wrong to think that. An unmodified hammer, screwdriver, wrench, knife or anything like that can be charged as a burglary tool, if the police feel you are a bad person. And yes, people routinely go to prison for possessing a regular unmodified screwdriver. Using it for burglary is not required at all under the law. It doesn't matter even a tiny bit if the tools can also be used for good. So when your house gets raided and the police find no actual evidence that you've done anything wrong, but you possess hacking tools, well... if they don't lay any charges that means they were dumb for making the raid in the first place.

fauigerzigerk 15y ago

It's things like this seatbelt comparison that leave me scratching my head about politicians sometimes. How can you even argue with people who lack the most basic appreciation of the issue at hand?

m0skit0 15y ago

Nonsense. As such tools cannot be used to find and patch vulnerabilities. And even if banned, real hackers can code such apps themselves, while sysadmins are not that skilled and will be stuck with no weapons at all.

quadhome 15y ago
Weapons?
- deleted 15y ago
  [deleted]

zacharyvoase 15y ago

Here is my concern: that the EU will make an exemption for security researchers/white-hat hackers, but only those recognised by a certain qualification or professional body. Governments around the world already mandate professional licenses for many industries, and IT is so critical that it's only a matter of time until we see a 'License to Code'.

unimpressive 15y ago
I'm going to be clear with you; I've lost sleep over this. I continue to lose sleep over this. The thing is, no matter how much I wish it were so. I don't feel that (and in reality I do not.) I have the financial or political capital to really do anything in the realm of significance about this. I'm not articulating the prior points because I seek pity or want to hear similar views from people who sympathize with my position. I instead would like a simple question answered: What's the best thing I can do to stop things like this from happening?
- phillmv 15y ago
  Well… of course you do. You're a well educated, well informed professional capable of using the internet who is solidly in the middle class. People like you are the core of every group of people seeking change. What do you do? You form an organization, a lobbying group. Organizations are the base unit of power. You throw up a website, you get as many like minded people as possible (literally, thousands) to sign up for your mailing list and you badger every single person you can find across the political spectrum on the issue. You write letters to politicians, you write software that makes phone calls, you get people who run companies who would be affected by the issue to give you financial and moral support, and you try to talk directly to every politician or candidate to be a politician on the issue. Ideally, albeit hard on this weird technocratic issue, you get some mass public outrage on the topic. With some luck, you can go: small company CEO who knows a medium company CEO who hangs out with someone higher up who can have a one on one with people who actually vote on the issue. The catch is, before this is over it will be a more-than-full-time-job but… it's a startup like any other. This is how any issue becomes mainstream: there are a bunch of people working round the clock on it. Think about illegal trade unions in Poland in 1978 or gay people going from being beaten indiscriminately by the cops in 1969 to being on the verge of legalizing marriage across the West. In the meantime, get started by having you and all of your friends write personal letters and call your eurodeputies (not having clicked on TFA I assume that's the body in question).

joeybaker 15y ago

This is really just an example of lawmakers not understanding what they're legislating. "hacking tools" are also known as 'development tools'. This sort of proposal is only made when completely oblivious about the operation of computers/the Internet/two-side coins.

itsuart 15y ago

> [...] computer programs [...] which find a computer password by which an information system can be accessed, would constitute criminal offences. So, possessing 'net use' and 'ssh' now criminal offense in EU? Oh wait, so do all password recovering tools! One better never forget passwords or risk be prosecuted.

dave1010uk 15y ago

Are full details of the "draft law" visible to the public? From the article: The proposal also targets tools used to commit offences: the production or sale of devices such as computer programs designed for cyber-attacks, or which find a computer password by which an information system can be accessed, would constitute criminal offences. Many tools can be used to "find a computer password by which an information system can be accessed". For example a browser's view source function could expose passwords in a (really insecure) site. Depending on how the law is worded, tools like curl, wget (or even telnet) could be defined as hacking tools.

tomjen3 15y ago
Plus it is going to be illegal to produce them. What are you going to do? Remove my C compiler? Only allow visual basic?
- hereonbusiness 15y ago
  I'm afraid VB will be the first one to go. It's gotten too much attention because of people using it to create GUI interfaces to track IP addresses :D
  - tomjen3 15y ago
    (I realise that you are joking) Won't matter. As long as one language exist, one can write a compiler for any other language in that language. Hopefully something other than Maelbolge will be the surviving language.

hereonbusiness 15y ago

Banning software, seriously? I get that most of them obviously have a very limited competency in regards to technology in general (seatbelts?), but they do have advisors who should know better. What is next on the agenda? Banning BitTorrent/p2p clients, media players, cd/dvd ripping software, video/audio capture software to fight piracy?

andrewflnr 15y ago
Quite possibly, if they don't get burned on this one.

voodoochilo 15y ago

propaganda, fear, technical ignorance, prevention-mania and centralistic tendencies lead to such legisation. i'm ashamed to be a eu citizen.

mariuolo 15y ago

What about double-use tools, like network diagnostics and the likes?

vlisivka 15y ago
What about your brain, the best hacking tool?

ggwicz 15y ago

So every single computer owner will be a criminal?

guard-of-terra 15y ago

I can totally imagine a court in e.g. some backcountry town in the middle of nowhere declaring some standard utility bundled with Ubuntu a "hacking tool", and immediately every linux user in EU is a criminal.

Freestyler_3 15y ago

"No car manufacturer may send a car without a seatbelt into the streets. And if this happens, the company will be held liable for any damage." I don't see the resemblance between that and this: "Cyber attacks on IT systems would become a criminal offence" :|

scanr 15y ago

This is the sectools list of 'hacking tools': * http://sectools.org http://sectools.org Here's the intersection of that list with what I have installed on my machine: * Firefox * Netcat * Curl * tcpdump * Wireshark * OpenSSH / SSH * Ping/telnet/dig/traceroute/whois/netstat * Perl/Python/Ruby * Google (ha, ok, perhaps not installed on my machine) * VMware * OpenSSL * Firebug * GDB

ez77 15y ago
That was my first thought. Will downloading tcpdump get you in trouble? What if it's "homemade"? Compilers will be next, since the enable the creation of these tools...

mih 15y ago

What does this mean for the future of distros such as Backtrack Linux? Could anybody comment. It's still unclear as to what exactly they refer to by hacking tools. Such things were always a two-edged knife.

tomelders 15y ago

we are governed by idiots.

deleted 15y ago

[deleted]

sasoon 15y ago

So possesion of a knife should also be a criminal offence...

anty 15y ago

Where does it state in the article that possession of hacking tools is made a criminal offence?

droithomme 15y ago

<sarcasm>That should really improve security!</sarcasm> Explanation: Obviously black hats will continue to do as before. White hats not being able to analyze threats though will be a serious problem. It's not sufficient to claim that special licenses will be given to worthy white hat operations with the proper certifications, protocols and willingness to bow to the man since nearly all vulnerability reports come from small operations and private parties that will be off the radar. These folks will simply stop.

eneveu 15y ago

I guess my timing was off when I first submitted this two days ago at http://news.ycombinator.com/item?id=3787597 http://news.ycombinator.com/item?id=3787597 I'll repost here the links from my comment there: HN discussion from last year on this subject: http://news.ycombinator.com/item?id=2654346 http://news.ycombinator.com/item?id=2654346 Blog posts with some more analysis and links to draft reports / amendments: http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the-fud-line/ http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t... http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the-fud-line-cont/ http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t...

vilya 15y ago

I started R'ing TFA and thought the title of the post was just editorialising, until I got to this: "The proposal also targets tools used to commit offences: the production or sale of devices such as computer programs designed for cyber-attacks, or which find a computer password by which an information system can be accessed, would constitute criminal offences." I've known numerous sysadmins who regularly run a password cracker over their login database, so that they can warn people who have weak passwords. This helps out the individuals concerned and increases the overall security of the system, yet it looks like this would become a criminal offence as a result of this bill.

telemekus 15y ago

So Notepad++ and Vi/Vim will be outlawed now then?