3 ms·

I actually like article 7, 8, 9, 10 and 11. It requires banning the development and sale of things like Pegasus, rootkits etc. If your software is only intende

I actually like article 7, 8, 9, 10 and 11. It requires banning the development and sale of things like Pegasus, rootkits etc. If your software is only intended to demonstrate the existence of a security flaw but contains no payload, then it is less obviously criminal. Still technically so, I suppose, but not so obviously that you couldn't make some kind of argument. The collection of traffic and 'content' data is not beneficial though, so I suppose the treaty has to go for that reason.

vlovich123 2y ago
> While establishing a basis for "mutual legal assistance", assistance may be denied "if the authorities of the requested State Party would be prohibited by its domestic law from carrying out the action requested with regard to any similar offence, had it been subject to investigation, prosecution or judicial proceedings under their own jurisdiction". > But: a State Party "shall not decline to act" under the provisions of the freezing, seizure and confiscation of the proceeds of crime "on the ground of bank secrecy". The Convention is expected to be adopted by the end of the year. So Russia and any other can country can ask for records on any US person they want under a pretext of committing some crime there and unless the US is itself investigating this party then it's allowed? & conversely, if the US tried to do this Russia or any hostile country can just claim they're investigating said persons in crimes? Surely my reading of this is absurd & it's not actually this badly written? It's particularly telling that it was Russia & China who proposed it in 2017 in the first place.
- FabHK 2y ago
  I think you’re reading it wrong. Say a foreign law enforcement entity is investigating Mr X, and asking a domestic authority for some information on Mr X. The treaty says that generally speaking, the domestic authority should provide such assistance. However, assume that instead another domestic law enforcement entity was asking the domestic authority for information on Mr X, but (under purely domestic jurisdiction) the domestic authority would be prohibited to provide such assistance for some reason (say, due to privacy laws, procedural protections, or so). Then, the foreign law enforcement entity would not be entitled to the assistance, either.
  - vlovich123 2y ago
    I don't see how that changes anything I wrote. For example, take Bill Browder - Russia has been continuously harassing this man even getting an Interpol red notice to be issued against him to rendition him to Russia on trumped up charges because he stood up to Putin. So they issue a request to the bank with a validly issued subpeona in Russian courts. Since a bank would have to issue records to a domestic warrant, it'll now have to issue it for a foreign obtained warrant. You kind of just reworded what I wrote but I don't see how it changes any of the concerns I expressed.
- zrail 2y ago
  You're making a pretty bold assumption that the US will ratify this. The US does not make a habit of ratifying UN conventions.
  - walterbell 2y ago
    https://news.ycombinator.com/item?id=41222487 https://news.ycombinator.com/item?id=41222487 > Advocates including the Biden administration said the deal reflects the interests of the U.S. and its allies.
    - vlovich123 2y ago
      Yeah - that's the scary part. It seems like this has approval of the current administration so either I'm missing something critical about the protections this treaty has or this is really really bad.
deleted 2y ago
[deleted]
zelphirkalt 2y ago
> If your software is only intended to demonstrate the existence of a security flaw but contains no payload, then it is less obviously criminal. Still technically so, I suppose, but not so obviously that you couldn't make some kind of argument. I do not see anything criminal at all in writing some malware or exploits. _Applying_ them to a system, where they might cause damage however, that is a completely different matter. You don't go after the blacksmith or manufacturer of kitchen knifes or guns either. You go after the one using them for the wrong purpose.
- msh 2y ago
  A knife have legal purposes to be used. Does malware?
  - ok_dad 2y ago
    Would you prefer only criminals research security issues?
  - layer8 2y ago
    Unlocking bricked systems you own.
    - ivan_gammel 2y ago
      This implies certain user interface that is different from criminal use cases. I.e. certain types of knives are considered weapons rather than kitchen appliances and even carrying them will get you problems in some jurisdictions.
- jltsiren 2y ago
  It's often the intentions that matter. Doing X may not be a crime, but doing it with the intention to commit crime could be. And while outsiders can't know the true intentions, courts are often happy accept the intentions seen by a "reasonable person" as the truth. Which means that if you want to write malware, you should look like a respectable person and not do anything too shady.
- 2y ago
onetokeoverthe 2y ago
[dead]

vlovich123 2y ago

> While establishing a basis for "mutual legal assistance", assistance may be denied "if the authorities of the requested State Party would be prohibited by its domestic law from carrying out the action requested with regard to any similar offence, had it been subject to investigation, prosecution or judicial proceedings under their own jurisdiction". > But: a State Party "shall not decline to act" under the provisions of the freezing, seizure and confiscation of the proceeds of crime "on the ground of bank secrecy". The Convention is expected to be adopted by the end of the year. So Russia and any other can country can ask for records on any US person they want under a pretext of committing some crime there and unless the US is itself investigating this party then it's allowed? & conversely, if the US tried to do this Russia or any hostile country can just claim they're investigating said persons in crimes? Surely my reading of this is absurd & it's not actually this badly written? It's particularly telling that it was Russia & China who proposed it in 2017 in the first place.

FabHK 2y ago
I think you’re reading it wrong. Say a foreign law enforcement entity is investigating Mr X, and asking a domestic authority for some information on Mr X. The treaty says that generally speaking, the domestic authority should provide such assistance. However, assume that instead another domestic law enforcement entity was asking the domestic authority for information on Mr X, but (under purely domestic jurisdiction) the domestic authority would be prohibited to provide such assistance for some reason (say, due to privacy laws, procedural protections, or so). Then, the foreign law enforcement entity would not be entitled to the assistance, either.
- vlovich123 2y ago
  I don't see how that changes anything I wrote. For example, take Bill Browder - Russia has been continuously harassing this man even getting an Interpol red notice to be issued against him to rendition him to Russia on trumped up charges because he stood up to Putin. So they issue a request to the bank with a validly issued subpeona in Russian courts. Since a bank would have to issue records to a domestic warrant, it'll now have to issue it for a foreign obtained warrant. You kind of just reworded what I wrote but I don't see how it changes any of the concerns I expressed.
zrail 2y ago
You're making a pretty bold assumption that the US will ratify this. The US does not make a habit of ratifying UN conventions.
- walterbell 2y ago
  https://news.ycombinator.com/item?id=41222487 https://news.ycombinator.com/item?id=41222487 > Advocates including the Biden administration said the deal reflects the interests of the U.S. and its allies.
  - vlovich123 2y ago
    Yeah - that's the scary part. It seems like this has approval of the current administration so either I'm missing something critical about the protections this treaty has or this is really really bad.

deleted 2y ago

[deleted]

zelphirkalt 2y ago

> If your software is only intended to demonstrate the existence of a security flaw but contains no payload, then it is less obviously criminal. Still technically so, I suppose, but not so obviously that you couldn't make some kind of argument. I do not see anything criminal at all in writing some malware or exploits. _Applying_ them to a system, where they might cause damage however, that is a completely different matter. You don't go after the blacksmith or manufacturer of kitchen knifes or guns either. You go after the one using them for the wrong purpose.

msh 2y ago
A knife have legal purposes to be used. Does malware?
- ok_dad 2y ago
  Would you prefer only criminals research security issues?
- layer8 2y ago
  Unlocking bricked systems you own.
  - ivan_gammel 2y ago
    This implies certain user interface that is different from criminal use cases. I.e. certain types of knives are considered weapons rather than kitchen appliances and even carrying them will get you problems in some jurisdictions.
jltsiren 2y ago
It's often the intentions that matter. Doing X may not be a crime, but doing it with the intention to commit crime could be. And while outsiders can't know the true intentions, courts are often happy accept the intentions seen by a "reasonable person" as the truth. Which means that if you want to write malware, you should look like a respectable person and not do anything too shady.
2y ago

onetokeoverthe 2y ago

[dead]