8 ms·

EU wants to criminalize "Hacking Tools"

169 points by drKarl 15y ago

drKarl 15y ago
I wonder if they include most of the unix/linux command line tools like nmap, netcat, etc... Laws about computers made by computer illiterates...
- nitrogen 15y ago
  I believe I've heard that there are virus scanners that will immediately delete any copy of netcat they come across.
perlpimp 15y ago
Bold move but may undercut the knowledge base in EU in terms of Computer Security. Because in CompSec if you don't know how to break it, you don't know how to secure it. Hacker( the other meaning ) community is a part of the internet and a quote as old as internet is: The Net treats censorship as a defect and routes around it. -- John Gilmore.
dlsym 15y ago
In Germany there already is a law called "Hacker(tools)paragraf" (§ 202c StGB). It roughly states, that if you provide, create, sell, or distribute tools, which can / will be used to commit / prepare a computer related crime, shall be punished with one year in prison or a fine. The problem with this is the vague wording: If dual-use tools like nmap are affected is open to discussion. Maybe someone else finds a better translation; you can find the original text here: http://de.wikipedia.org/wiki/Hackerparagraf http://de.wikipedia.org/wiki/Hackerparagraf
- Fargren 15y ago
  How does that not affect every OS ever?
- pagekalisedown 15y ago
  I would hate to be someone teaching networking in Germany right now. This "paragraph" is throwing out the baby with the bath water.
  - jk4930 15y ago
    After criticism they made clear that the good-intended use of those tools is legal.
fratido 15y ago
Yeah, german legislation for erveryone!</sarcasm> "Hacking tools" were made illegal 5 years ago in germany, resulting in a huge outcry and face palms from those involved in security research (and gnu-tool users)
jacquesm 15y ago
Sam gets arrested because he's carrying burglary tools at 03:00 in the morning and gets charged with burglary. Defending himself he appears before the judge and asks the judge if they're going to accuse him of rape as well. The judge, somewhat surprised at the turn of events bellows: "Don't tell me that you raped a woman as well?" Sam responds: "No, obviously not. But I was carrying my tools.". -- Even if you had the worst of the worst hacking tools sitting around on your system, it should be the actual use of those tools against someone else's machine for which you have no permission to access that creates the offence. Those that break in to systems are not going to be deterred by this at all and those that make a living doing penetration tests and such will be unable to do their job giving the bad guys a nice advantage. Silly lawmakers making silly laws with the best of intentions are the worst thing that can happen. I really wished they would limit their lawmaking to areas where they have some expertise.
- TazeTSchnitzel 15y ago
  Yup. I don't think these people are smart enough to realise that making something illegal does not necessarily make something stop happening.
  - CodeMage 15y ago
    Maybe I'm just too cynical, but I believe they are smart enough to realize that and they just don't care. Lawmaking in modern society is inextricably tied to politics and this seems yet another politically motivated piece of legislation.
  - glesica 15y ago
    I agree with you that they probably aren't very smart, most of them anyway. However, if you bump up a cynicism level just a tad, here's what you get: They don't need to stop people from possessing or using "hacking tools", they just need to make the tools illegal so they have one more stick with which to beat people into submission. In fact, it's better if people don't stop using the tools. For example, say the government wants to do some extra-judicial harm to an annoying person or group (Wikileaks comes to mind). The company hosting the data won't cooperate, so the government "finds out" that they use unlicensed "hacking tools" as part of their business. Now the company is given a choice by the government: hand over the data we want (even though you aren't required to do so under the law) or we file charges for your possession of "hacking tools" and make life hell for your company and staff. Now, don't get hung up on the details of my example. These sorts of situations are easy to think of and they happen all the time (article a while back about cops around St. Louis comes to mind). The basic principle is that if everyone is a criminal, whether they intend to be or not, then the government has unlimited power over people through its ability to cut deals with criminals. It can coerce anyone to do anything regardless of constitutional or similar safeguards because it can punish anyone at any time. Maybe you aren't that cynical (not sure I am, in fact), but I'd rather keep laws like this one off the books, just in case.
fromhet 15y ago
In my newly awaken state I first thought this was from The Onion. That's where it should be, at least.
adsr 15y ago
What is considered a hacking tool? Does it only affect highly automated, single purpose tools which can not be used in any legitimate way, or does it affect things like hexdump or nc? Also, who makes the distinction? Is it eveluated on a case by case basis by the court or is there a list of "verboten" tools?
- guard-of-terra 15y ago
  Let me guess, it is evaluated on per case basis and then it gets into the list. Some stupid court in the middle of nowhere outlaws tcpdump and then every linux user is a criminat.
- m0skit0 15y ago
  They don't even know because most of this "clever" politicians have absolutely no idea what "hacking" actually means, let alone a "hacking tool"...
- pyrhho 15y ago
  Also, would this include just guessing passwords? As that seems to have fallen into the common definition of 'hacking'...
jjoergensen 15y ago
EU internet laws has no effect. Look at the cookie legislation that made it impossible to set cookies on peoples machines without explicit consent. What is dangerous is that one day they may be put into use. But for now they are just largely ignored.
- zalew 15y ago
  Yeah, except recently our govt (Poland) got to this 'brilliant' idea http://hackerne.ws/item?id=3794883 http://hackerne.ws/item?id=3794883 //edit: original to translate in case the above doesn't work http://www.tvn24.pl/-1,1740364,0,1,rzad-bierze-sie-za-ciasteczka,wiadomosc.html http://www.tvn24.pl/-1,1740364,0,1,rzad-bierze-sie-za-ciaste...
  - FreeFull 15y ago
    That link only gives me an empty page
    - DougWebb 15y ago
      Maybe that's now the only legal kind of web page in Poland?
    - zalew 15y ago
      works for me, I added another url
- dasil003 15y ago
  Actually I've already personally had the lawyers for a partner ram this one down my throat in the UK. It's absolutely ridiculous how out of their depth these legislators are. To take an idea that is readily implementable and enforceable at the browser level, but instead attempt to force every website operator in the world to implement it poorly at the server/application level is lunacy. I'm all for privacy legislation, but in this case lawmakers' ignorance is only matched by their hubris.
- aes256 15y ago
  Uh, the cookie directive isn't being ignored. In the UK, for example, the directive was implemented on 26 May 2011, but website owners were granted a 12 month grace period to 'get their house in order'. From 26 May 2012 site owners will face penalties for non-compliance.
TazeTSchnitzel 15y ago
Brilliant. I commend the EU on its harsher stance on cyber security, cracking down on criminal computer usage and protecting the systems crucial to how we live our lives.</sarcasm> So now we can't use penetration testing tools? I'm sure computer systems will be much more secure without the threat of security testing software, especially since the only threats we know of are from the EU. Oh wait.
experiment0 15y ago
This type of legislation clearly stems from ignorance and a lack of understanding. It infuriates me that people can make judgements like this without actually understanding what they are making judgements on.
phn 15y ago
Well, a computer itself is an hacking tool, no?
- m0skit0 15y ago
  In fact your brain is a hacking tool, so everyone born with a working brain could go to jail.
  - bullseye 15y ago
    Which means politicians would once again be exempt from the laws they create.
jiggy2011 15y ago
Wouldn't this in effect make credit card handling software etc impossible to create within the EU? I'm fairly sure part of "due diligence" would be to perform some form of security audit / penetration test which this would render illegal.
- Chris_Newton 15y ago
  I suspect it's much worse than that. Consider a tool like Wireshark, which is widely used by people developing and testing all kinds of networking software, which in turn handle small tasks like running every home and office network on the planet, not to mention the Internet. Of course, any protocol analyser that you can hook up to your switch/router/etc. to make sure it's sending the right traffic in the right directions could also be stuck on a laptop near any unsecured WiFi network and used to sniff other network users' unencrypted traffic. The correct solution to this problem, if secure communications is your primary concern, is for the people who understand the technical and security implications to make networking secure by default. Get rid of unsecured WiFi and replace it with something using full-time encryption. It's also important to educate users of insecure networks so they understand the risks and know what to look out for and what they should do and not do to protect themselves. Use HTTPS where it's available, check you've got the little padlock icon before you type private information into a web site, that kind of thing. Obviously much of this is good practice if you're using the Internet, even if your immediate connection is over an encrypted wireless link. Of course, there is always option 3: do nothing about the technical vulnerability, but legislate to ban Wireshark and numerous other "hacking tools" like it in the hope that bad people won't exploit that vulnerability. Unfortunately we'll probably have to close down the Internet shortly afterwards and revert to connecting a printer to everyone's PC at the office so they can exchange documents, because no-one will be able to make any networking kit that actually works any more. But that's a small price to pay, for at least we will have stopped Evil Hackers from monitoring our networks! (Obviously there's a little hyperbole in that last part. But only a little...)
Craiggybear 15y ago
Everything is a hacking tool. Every programming language and every pre-existing piece of software, every computer and every phone is a potential hacking tool. Thought itself is the biggest hacking tool. How are these fucking morons going to define legally what is and isn't a "hacking tool"?
- neilk 15y ago
  The law has no trouble at all making fuzzy distinctions. They are attempting to keep the peace, not make orthogonal cuts into reality. We programmers need absolute clarity because our systems are executed by machines with no insight. But in other fields where humans execute rules, everyone else just shrugs and deals with little inconsistencies, or make meta-rules about judging "intent", that sort of thing.
  - tripzilch 15y ago
    > The law has no trouble at all making fuzzy distinctions. Actually, in most of Europe it does. While the US, UK and Ireland's legal system is based on "Common Law", most of Europe uses "Civil Law", where the primary source of law is the law code, which is a systematic collection of interrelated articles that explain the principles of law, rights and entitlements, and how basic legal mechanisms work. Of course there's still a lot of room for interpretation and pragmatics, but the point is that right from the start, you try to get your definitions down as clear as possible. It's quite interesting to see how the fundamentals of our legal systems actually differ. I decided to look this up for the first time because at some point I read some thread where some US people were actively discussing interpretation of your Constitution or the Bill of Rights, as to whether something fairly trivial to define could be ruled or not--might even have had to do with the right to bear arms, but the specifics aren't important. I was just amazed that this centuries-old document was seriously being "consulted" as if somewhere between the lines would appear some sort of hidden meaning--except it was pretty obvious that the final decision would rest with the interpretation and political ideas of whatever judge got to rule it. Which completely amazed me, it's one thing if somnewhere, in some obscure corner of fiscal tax laws some particular exception to a rule isn't defined unambiguously, but the big-to-medium picture of the law is not supposed to be up for interpretation! Except in the US, or more precisely in Common Law legal systems, that's pretty much the idea. I'm not saying it's bad BTW, it's just different. And I'm just commenting on how surprised I was that there's other ways (in democratic countries) than to strictly codify your laws. [1] http://en.wikipedia.org/wiki/Common_law#2._Common_law_legal_systems_as_opposed_to_civil_law_legal_systems http://en.wikipedia.org/wiki/Common_law#2._Common_law_legal_... [2] http://en.wikipedia.org/wiki/Civil_law_(legal_system) http://en.wikipedia.org/wiki/Civil_law_(legal_system)
richieb 15y ago
Isn't a computer a "hacking tool"?
- randomdata 15y ago
  This seems like the obvious ban. If you outlaw computers, honest people won't be able to use them, leaving no systems for the dishonest people to hack into.
- deleted 15y ago
  [deleted]
- mjwalshe 15y ago
  Yes and so are floppy disks - the only hacking (authorised) I had to do was to recover paswords for a customer and I used a floppy disk to extract the secrets from the nt machines.
verelo 15y ago
How far doe this go? Can i have a laptop with vi or nmap installed? I imagine most DOS attacks come from people with a pretty generic install, vi and an internet connection.
doki_pen 15y ago
The argument that this would hurt legitimate hacking is a bad one. The example given was white hats hacking into e-voting machines. You aren't allowed to break into government buildings to make sure they are secure, it's illegal. As far as preventative laws go, I don't think they are right but they are widely accepted by most people as right. I'll use one that most people agree with as an example. Drunk driving in and of itself doesn't hurt anyone, and some people can do it their entire lives without ever getting in an accident. But we make it illegal to try and prevent people from killing each other.
- mattstreet 15y ago
  Yes you can't break into government buildings to show they are insecure, but you could buy the same kind of door as they have, and show how insecure it is. I think this is how a lot of the e-voting machine hacks are done.
dguido 15y ago
This article is a little bit sensationalist. Here is analysis of the actual text of the law: http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the-fud-line/ http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t... http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the-fud-line-cont/ http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t...
jakeonthemove 15y ago
Well, I don't know what to say - this is just stupid. I hope it doesn't go through, but if it does, I'll just store all the potential "hacking tools" on a server in the US, or China, or Japan, or Brazil, or Australia... or encrypted UHS SD cards (it took them a while, but they already know about encrypted hard drives, you see :-)... Seriously, how is this even going to be enforceable (especially with the push for cloud storage)?
siculars 15y ago
So would Chrome and Mozilla have to disable "view source" and "developer mode"? Would Apple have to stop shipping Xcode? Would I have to register with an "authority" as a developer? Like a boxer registering his fists as "deadly weapons"? The insanity continues...
lvh 15y ago
This is a dupe. Original source: http://news.ycombinator.com/item?id=3797026 http://news.ycombinator.com/item?id=3797026 When the original got posted, I already called the MEP in question: http://news.ycombinator.com/item?id=3797114 http://news.ycombinator.com/item?id=3797114 TL;DR: They already know this is silly and the final law text will not criminalize tools being used in a research/penetration testing context. Nothing to see here, move along...
cs702 15y ago
Almost all politicians in power today (1) didn't grow up with a pervasive Internet, and (2) truly don't understand information technology. For example, the median age of US Senators is currently 62 years [1], and not a single one of them is an engineer (let alone a software developer) [2]. Consider how the term "dangerous hacking tool" sounds to a 62 year-old person who doesn't have even a basic understanding of how software works. No wonder they want to outlaw these "weapons"! Alas, it's probably too late and too difficult to teach these old dogs new tricks. Realistically, we should expect more idiotic political decisions to be made... until a new generation of politicians (with a better understanding of software and the Internet) gradually takes over. I wish I could be more optimistic about this. [1] http://en.wikipedia.org/wiki/List_of_current_United_States_Senators_by_age http://en.wikipedia.org/wiki/List_of_current_United_States_S... [2] http://www.senate.gov/reference/resources/pdf/R41647.pdf http://www.senate.gov/reference/resources/pdf/R41647.pdf
- harshreality 15y ago
  It's not obvious that the next generation of politicians will be much better. Using computers, including iOS and Android devices, is not enough. Technically minded individuals who understand how those devices work below the surface are still unlikely to go into politics.
archgoon 15y ago
The Low Orbit Ion Cannon isn't a DDoS tool, it's a crowd sourced network stress testing utility!
antihero 15y ago
If you are in the UK, please consider writing to your MEP(s): http://www.writetothem.com http://www.writetothem.com
redbeard0x0a 15y ago
What about hacking tools that have been installed on your machine without your knowledge, i.e. malware that runs DDoS attacks?
godDLL 15y ago
> While the law seems aimed at blackmarket tools that can be used to create malware infested sites, it’s also likely to criminalize tools used by researchers, developers and black hats alike – including tools like fuzzers, the Metasploit penetration testing tool and the wi-fi sniffing tool Wireshark. (Perhaps even the command line would be outlawed.) They take away your guns, so that you can not rebel against them.
pbhjpbhj 15y ago
It's already illegal in the UK to enter and/or use a computer system without permission, you don't even have to crack it. Presumably this is true in most of the EU too. So, the only reason I can see that anyone would want this law is so you can prosecute without having to show someone committed a real crime. Kinda like having a law saying you could prosecute people for hit-and-run if they own a car. If the "hacking tools" are capable of causing near instantaneous death then I think there's an argument for it. Otherwise this seems to be over-stretching the law to infringe on hackers liberties.
alexqgb 15y ago
The temptation to pass laws like this (an unstoppable force) exists in fundamental opposition to the reality of tools as powerful, as versatile, as cheap, and as highly distributed personal computers (the immovable object). This conflict is the essence of Cory Doctorow's thesis that all the superficially-unrelated tech related battles we've seen are simply proxy fights in the War on General-Purpose Computing. I know that opinions about Cory vary considerably, but if there's one article that everyone should consider with an open mind, this is it: http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html
urza 15y ago
We need to reinvent the law making! The current system is simply outdated.
rosser 15y ago
"Perhaps even the command line would be outlawed." Jesus, Wired. Sensationalize much?
mgogov 15y ago
I live in the EU and this is simply ridiculous.

169 points by drKarl 15y ago

I wonder if they include most of the unix/linux command line tools like nmap, netcat, etc... Laws about computers made by computer illiterates...

nitrogen 15y ago
I believe I've heard that there are virus scanners that will immediately delete any copy of netcat they come across.

perlpimp 15y ago

Bold move but may undercut the knowledge base in EU in terms of Computer Security. Because in CompSec if you don't know how to break it, you don't know how to secure it. Hacker( the other meaning ) community is a part of the internet and a quote as old as internet is: The Net treats censorship as a defect and routes around it. -- John Gilmore.

dlsym 15y ago

In Germany there already is a law called "Hacker(tools)paragraf" (§ 202c StGB). It roughly states, that if you provide, create, sell, or distribute tools, which can / will be used to commit / prepare a computer related crime, shall be punished with one year in prison or a fine. The problem with this is the vague wording: If dual-use tools like nmap are affected is open to discussion. Maybe someone else finds a better translation; you can find the original text here: http://de.wikipedia.org/wiki/Hackerparagraf http://de.wikipedia.org/wiki/Hackerparagraf

Fargren 15y ago
How does that not affect every OS ever?
pagekalisedown 15y ago
I would hate to be someone teaching networking in Germany right now. This "paragraph" is throwing out the baby with the bath water.
- jk4930 15y ago
  After criticism they made clear that the good-intended use of those tools is legal.

fratido 15y ago

Yeah, german legislation for erveryone!</sarcasm> "Hacking tools" were made illegal 5 years ago in germany, resulting in a huge outcry and face palms from those involved in security research (and gnu-tool users)

jacquesm 15y ago

Sam gets arrested because he's carrying burglary tools at 03:00 in the morning and gets charged with burglary. Defending himself he appears before the judge and asks the judge if they're going to accuse him of rape as well. The judge, somewhat surprised at the turn of events bellows: "Don't tell me that you raped a woman as well?" Sam responds: "No, obviously not. But I was carrying my tools.". -- Even if you had the worst of the worst hacking tools sitting around on your system, it should be the actual use of those tools against someone else's machine for which you have no permission to access that creates the offence. Those that break in to systems are not going to be deterred by this at all and those that make a living doing penetration tests and such will be unable to do their job giving the bad guys a nice advantage. Silly lawmakers making silly laws with the best of intentions are the worst thing that can happen. I really wished they would limit their lawmaking to areas where they have some expertise.

TazeTSchnitzel 15y ago
Yup. I don't think these people are smart enough to realise that making something illegal does not necessarily make something stop happening.
- CodeMage 15y ago
  Maybe I'm just too cynical, but I believe they are smart enough to realize that and they just don't care. Lawmaking in modern society is inextricably tied to politics and this seems yet another politically motivated piece of legislation.
- glesica 15y ago
  I agree with you that they probably aren't very smart, most of them anyway. However, if you bump up a cynicism level just a tad, here's what you get: They don't need to stop people from possessing or using "hacking tools", they just need to make the tools illegal so they have one more stick with which to beat people into submission. In fact, it's better if people don't stop using the tools. For example, say the government wants to do some extra-judicial harm to an annoying person or group (Wikileaks comes to mind). The company hosting the data won't cooperate, so the government "finds out" that they use unlicensed "hacking tools" as part of their business. Now the company is given a choice by the government: hand over the data we want (even though you aren't required to do so under the law) or we file charges for your possession of "hacking tools" and make life hell for your company and staff. Now, don't get hung up on the details of my example. These sorts of situations are easy to think of and they happen all the time (article a while back about cops around St. Louis comes to mind). The basic principle is that if everyone is a criminal, whether they intend to be or not, then the government has unlimited power over people through its ability to cut deals with criminals. It can coerce anyone to do anything regardless of constitutional or similar safeguards because it can punish anyone at any time. Maybe you aren't that cynical (not sure I am, in fact), but I'd rather keep laws like this one off the books, just in case.

fromhet 15y ago

In my newly awaken state I first thought this was from The Onion. That's where it should be, at least.

adsr 15y ago

What is considered a hacking tool? Does it only affect highly automated, single purpose tools which can not be used in any legitimate way, or does it affect things like hexdump or nc? Also, who makes the distinction? Is it eveluated on a case by case basis by the court or is there a list of "verboten" tools?

guard-of-terra 15y ago
Let me guess, it is evaluated on per case basis and then it gets into the list. Some stupid court in the middle of nowhere outlaws tcpdump and then every linux user is a criminat.
m0skit0 15y ago
They don't even know because most of this "clever" politicians have absolutely no idea what "hacking" actually means, let alone a "hacking tool"...
pyrhho 15y ago
Also, would this include just guessing passwords? As that seems to have fallen into the common definition of 'hacking'...

jjoergensen 15y ago

EU internet laws has no effect. Look at the cookie legislation that made it impossible to set cookies on peoples machines without explicit consent. What is dangerous is that one day they may be put into use. But for now they are just largely ignored.

zalew 15y ago
Yeah, except recently our govt (Poland) got to this 'brilliant' idea http://hackerne.ws/item?id=3794883 http://hackerne.ws/item?id=3794883 //edit: original to translate in case the above doesn't work http://www.tvn24.pl/-1,1740364,0,1,rzad-bierze-sie-za-ciasteczka,wiadomosc.html http://www.tvn24.pl/-1,1740364,0,1,rzad-bierze-sie-za-ciaste...
- FreeFull 15y ago
  That link only gives me an empty page
  - DougWebb 15y ago
    Maybe that's now the only legal kind of web page in Poland?
  - zalew 15y ago
    works for me, I added another url
dasil003 15y ago
Actually I've already personally had the lawyers for a partner ram this one down my throat in the UK. It's absolutely ridiculous how out of their depth these legislators are. To take an idea that is readily implementable and enforceable at the browser level, but instead attempt to force every website operator in the world to implement it poorly at the server/application level is lunacy. I'm all for privacy legislation, but in this case lawmakers' ignorance is only matched by their hubris.
aes256 15y ago
Uh, the cookie directive isn't being ignored. In the UK, for example, the directive was implemented on 26 May 2011, but website owners were granted a 12 month grace period to 'get their house in order'. From 26 May 2012 site owners will face penalties for non-compliance.

TazeTSchnitzel 15y ago

Brilliant. I commend the EU on its harsher stance on cyber security, cracking down on criminal computer usage and protecting the systems crucial to how we live our lives.</sarcasm> So now we can't use penetration testing tools? I'm sure computer systems will be much more secure without the threat of security testing software, especially since the only threats we know of are from the EU. Oh wait.

experiment0 15y ago

This type of legislation clearly stems from ignorance and a lack of understanding. It infuriates me that people can make judgements like this without actually understanding what they are making judgements on.

phn 15y ago

Well, a computer itself is an hacking tool, no?

m0skit0 15y ago
In fact your brain is a hacking tool, so everyone born with a working brain could go to jail.
- bullseye 15y ago
  Which means politicians would once again be exempt from the laws they create.

jiggy2011 15y ago

Wouldn't this in effect make credit card handling software etc impossible to create within the EU? I'm fairly sure part of "due diligence" would be to perform some form of security audit / penetration test which this would render illegal.

Chris_Newton 15y ago
I suspect it's much worse than that. Consider a tool like Wireshark, which is widely used by people developing and testing all kinds of networking software, which in turn handle small tasks like running every home and office network on the planet, not to mention the Internet. Of course, any protocol analyser that you can hook up to your switch/router/etc. to make sure it's sending the right traffic in the right directions could also be stuck on a laptop near any unsecured WiFi network and used to sniff other network users' unencrypted traffic. The correct solution to this problem, if secure communications is your primary concern, is for the people who understand the technical and security implications to make networking secure by default. Get rid of unsecured WiFi and replace it with something using full-time encryption. It's also important to educate users of insecure networks so they understand the risks and know what to look out for and what they should do and not do to protect themselves. Use HTTPS where it's available, check you've got the little padlock icon before you type private information into a web site, that kind of thing. Obviously much of this is good practice if you're using the Internet, even if your immediate connection is over an encrypted wireless link. Of course, there is always option 3: do nothing about the technical vulnerability, but legislate to ban Wireshark and numerous other "hacking tools" like it in the hope that bad people won't exploit that vulnerability. Unfortunately we'll probably have to close down the Internet shortly afterwards and revert to connecting a printer to everyone's PC at the office so they can exchange documents, because no-one will be able to make any networking kit that actually works any more. But that's a small price to pay, for at least we will have stopped Evil Hackers from monitoring our networks! (Obviously there's a little hyperbole in that last part. But only a little...)

Craiggybear 15y ago

Everything is a hacking tool. Every programming language and every pre-existing piece of software, every computer and every phone is a potential hacking tool. Thought itself is the biggest hacking tool. How are these fucking morons going to define legally what is and isn't a "hacking tool"?

neilk 15y ago
The law has no trouble at all making fuzzy distinctions. They are attempting to keep the peace, not make orthogonal cuts into reality. We programmers need absolute clarity because our systems are executed by machines with no insight. But in other fields where humans execute rules, everyone else just shrugs and deals with little inconsistencies, or make meta-rules about judging "intent", that sort of thing.
- tripzilch 15y ago
  > The law has no trouble at all making fuzzy distinctions. Actually, in most of Europe it does. While the US, UK and Ireland's legal system is based on "Common Law", most of Europe uses "Civil Law", where the primary source of law is the law code, which is a systematic collection of interrelated articles that explain the principles of law, rights and entitlements, and how basic legal mechanisms work. Of course there's still a lot of room for interpretation and pragmatics, but the point is that right from the start, you try to get your definitions down as clear as possible. It's quite interesting to see how the fundamentals of our legal systems actually differ. I decided to look this up for the first time because at some point I read some thread where some US people were actively discussing interpretation of your Constitution or the Bill of Rights, as to whether something fairly trivial to define could be ruled or not--might even have had to do with the right to bear arms, but the specifics aren't important. I was just amazed that this centuries-old document was seriously being "consulted" as if somewhere between the lines would appear some sort of hidden meaning--except it was pretty obvious that the final decision would rest with the interpretation and political ideas of whatever judge got to rule it. Which completely amazed me, it's one thing if somnewhere, in some obscure corner of fiscal tax laws some particular exception to a rule isn't defined unambiguously, but the big-to-medium picture of the law is not supposed to be up for interpretation! Except in the US, or more precisely in Common Law legal systems, that's pretty much the idea. I'm not saying it's bad BTW, it's just different. And I'm just commenting on how surprised I was that there's other ways (in democratic countries) than to strictly codify your laws. [1] http://en.wikipedia.org/wiki/Common_law#2._Common_law_legal_systems_as_opposed_to_civil_law_legal_systems http://en.wikipedia.org/wiki/Common_law#2._Common_law_legal_... [2] http://en.wikipedia.org/wiki/Civil_law_(legal_system) http://en.wikipedia.org/wiki/Civil_law_(legal_system)

richieb 15y ago

Isn't a computer a "hacking tool"?

randomdata 15y ago
This seems like the obvious ban. If you outlaw computers, honest people won't be able to use them, leaving no systems for the dishonest people to hack into.
deleted 15y ago
[deleted]
mjwalshe 15y ago
Yes and so are floppy disks - the only hacking (authorised) I had to do was to recover paswords for a customer and I used a floppy disk to extract the secrets from the nt machines.

verelo 15y ago

How far doe this go? Can i have a laptop with vi or nmap installed? I imagine most DOS attacks come from people with a pretty generic install, vi and an internet connection.

doki_pen 15y ago

The argument that this would hurt legitimate hacking is a bad one. The example given was white hats hacking into e-voting machines. You aren't allowed to break into government buildings to make sure they are secure, it's illegal. As far as preventative laws go, I don't think they are right but they are widely accepted by most people as right. I'll use one that most people agree with as an example. Drunk driving in and of itself doesn't hurt anyone, and some people can do it their entire lives without ever getting in an accident. But we make it illegal to try and prevent people from killing each other.

mattstreet 15y ago
Yes you can't break into government buildings to show they are insecure, but you could buy the same kind of door as they have, and show how insecure it is. I think this is how a lot of the e-voting machine hacks are done.

dguido 15y ago

This article is a little bit sensationalist. Here is analysis of the actual text of the law: http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the-fud-line/ http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t... http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the-fud-line-cont/ http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t...

jakeonthemove 15y ago

Well, I don't know what to say - this is just stupid. I hope it doesn't go through, but if it does, I'll just store all the potential "hacking tools" on a server in the US, or China, or Japan, or Brazil, or Australia... or encrypted UHS SD cards (it took them a while, but they already know about encrypted hard drives, you see :-)... Seriously, how is this even going to be enforceable (especially with the push for cloud storage)?

siculars 15y ago

So would Chrome and Mozilla have to disable "view source" and "developer mode"? Would Apple have to stop shipping Xcode? Would I have to register with an "authority" as a developer? Like a boxer registering his fists as "deadly weapons"? The insanity continues...

lvh 15y ago

This is a dupe. Original source: http://news.ycombinator.com/item?id=3797026 http://news.ycombinator.com/item?id=3797026 When the original got posted, I already called the MEP in question: http://news.ycombinator.com/item?id=3797114 http://news.ycombinator.com/item?id=3797114 TL;DR: They already know this is silly and the final law text will not criminalize tools being used in a research/penetration testing context. Nothing to see here, move along...

cs702 15y ago

Almost all politicians in power today (1) didn't grow up with a pervasive Internet, and (2) truly don't understand information technology. For example, the median age of US Senators is currently 62 years [1], and not a single one of them is an engineer (let alone a software developer) [2]. Consider how the term "dangerous hacking tool" sounds to a 62 year-old person who doesn't have even a basic understanding of how software works. No wonder they want to outlaw these "weapons"! Alas, it's probably too late and too difficult to teach these old dogs new tricks. Realistically, we should expect more idiotic political decisions to be made... until a new generation of politicians (with a better understanding of software and the Internet) gradually takes over. I wish I could be more optimistic about this. [1] http://en.wikipedia.org/wiki/List_of_current_United_States_Senators_by_age http://en.wikipedia.org/wiki/List_of_current_United_States_S... [2] http://www.senate.gov/reference/resources/pdf/R41647.pdf http://www.senate.gov/reference/resources/pdf/R41647.pdf

harshreality 15y ago
It's not obvious that the next generation of politicians will be much better. Using computers, including iOS and Android devices, is not enough. Technically minded individuals who understand how those devices work below the surface are still unlikely to go into politics.

archgoon 15y ago

The Low Orbit Ion Cannon isn't a DDoS tool, it's a crowd sourced network stress testing utility!

antihero 15y ago

If you are in the UK, please consider writing to your MEP(s): http://www.writetothem.com http://www.writetothem.com

redbeard0x0a 15y ago

What about hacking tools that have been installed on your machine without your knowledge, i.e. malware that runs DDoS attacks?

godDLL 15y ago

> While the law seems aimed at blackmarket tools that can be used to create malware infested sites, it’s also likely to criminalize tools used by researchers, developers and black hats alike – including tools like fuzzers, the Metasploit penetration testing tool and the wi-fi sniffing tool Wireshark. (Perhaps even the command line would be outlawed.) They take away your guns, so that you can not rebel against them.

pbhjpbhj 15y ago

It's already illegal in the UK to enter and/or use a computer system without permission, you don't even have to crack it. Presumably this is true in most of the EU too. So, the only reason I can see that anyone would want this law is so you can prosecute without having to show someone committed a real crime. Kinda like having a law saying you could prosecute people for hit-and-run if they own a car. If the "hacking tools" are capable of causing near instantaneous death then I think there's an argument for it. Otherwise this seems to be over-stretching the law to infringe on hackers liberties.

alexqgb 15y ago

The temptation to pass laws like this (an unstoppable force) exists in fundamental opposition to the reality of tools as powerful, as versatile, as cheap, and as highly distributed personal computers (the immovable object). This conflict is the essence of Cory Doctorow's thesis that all the superficially-unrelated tech related battles we've seen are simply proxy fights in the War on General-Purpose Computing. I know that opinions about Cory vary considerably, but if there's one article that everyone should consider with an open mind, this is it: http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html

urza 15y ago

We need to reinvent the law making! The current system is simply outdated.

rosser 15y ago

"Perhaps even the command line would be outlawed." Jesus, Wired. Sensationalize much?

mgogov 15y ago

I live in the EU and this is simply ridiculous.