3 ms·

Often I think authorities realize these laws are over-broad but don't care. They just selectively enforce. For example in NZ, the crimes amendment act 2003 all

Often I think authorities realize these laws are over-broad but don't care. They just selectively enforce. For example in NZ, the crimes amendment act 2003 allows for prosecution[1] of anyone who drops or sells 0day.[2] It's one of those laws which has never been enforced, but probably would be if you made a nuisance of yourself. --- http://www.legislation.govt.nz/act/public/2003/0039/latest/DLM200200.html http://www.legislation.govt.nz/act/public/2003/0039/latest/D... (Section 251 Making, selling, or distributing or possessing software for committing crime) [1] "liable to imprisonment for a term not exceeding 2 years" [2] The requirement is "the sole or principal use of which he or she knows to be the commission of a crime". However, gaining unauthorised or unlawful access to a computer system is a crime meaning exploits qualify.

wuest 14y ago
This sounds mostly reasonable at first glance. I'd have to dig a lot more into how it's played out in practice to have a fully-valid opinion, of course. The one thing you mention that worries me, though, is dropping 0day. Would this include full disclosure? Would this include developing an 0day as part of a pentest? How does this affect things even as far reaching as responsible/coordinated disclosure? If a law makes doing the right (let's use open disclosure, whether full and immediate or coordinated and timed just to mean "right" while selling 0days for ostensibly criminal purposes as "wrong" for the sake of this conversation) thing as difficult (or even more difficult) to do than the wrong thing, then the law will only bolster the black market.
- xyzzy123 14y ago
  These are open questions which have never been resolved since section 251 was introduced in 2003. Note that this is NZ law only and I am not sure of the situation internationally. Some relevant quotes: ----- http://www.giac.org/paper/gsec/4001/zealand-information-technology-security-legislation/106400 http://www.giac.org/paper/gsec/4001/zealand-information-tech... "Although most cases of legitimate have been covered, not all have. Section 251 does potentially raise some interesting issues around concepts that many security professionals are supportive of, the sharing of information and full disclosure..." http://www.bellgully.co.nz/newsletters/03CTM/03CTM_HackersBeware.asp http://www.bellgully.co.nz/newsletters/03CTM/03CTM_HackersBe... "On the face of it, such criticisms may be justified. Whether or not the Amendment Act will actually have this effect will only become clear through the passage of time. In this regard, “good” users of such information may have to rely (tentatively) on the police's discretion whether or not to prosecute a particular case."

wuest 14y ago

This sounds mostly reasonable at first glance. I'd have to dig a lot more into how it's played out in practice to have a fully-valid opinion, of course. The one thing you mention that worries me, though, is dropping 0day. Would this include full disclosure? Would this include developing an 0day as part of a pentest? How does this affect things even as far reaching as responsible/coordinated disclosure? If a law makes doing the right (let's use open disclosure, whether full and immediate or coordinated and timed just to mean "right" while selling 0days for ostensibly criminal purposes as "wrong" for the sake of this conversation) thing as difficult (or even more difficult) to do than the wrong thing, then the law will only bolster the black market.

xyzzy123 14y ago
These are open questions which have never been resolved since section 251 was introduced in 2003. Note that this is NZ law only and I am not sure of the situation internationally. Some relevant quotes: ----- http://www.giac.org/paper/gsec/4001/zealand-information-technology-security-legislation/106400 http://www.giac.org/paper/gsec/4001/zealand-information-tech... "Although most cases of legitimate have been covered, not all have. Section 251 does potentially raise some interesting issues around concepts that many security professionals are supportive of, the sharing of information and full disclosure..." http://www.bellgully.co.nz/newsletters/03CTM/03CTM_HackersBeware.asp http://www.bellgully.co.nz/newsletters/03CTM/03CTM_HackersBe... "On the face of it, such criticisms may be justified. Whether or not the Amendment Act will actually have this effect will only become clear through the passage of time. In this regard, “good” users of such information may have to rely (tentatively) on the police's discretion whether or not to prosecute a particular case."