5 ms·

I think that people participating in this thread might have a substantial misunderstanding of this executive order. This does not seem to create a policy where

I think that people participating in this thread might have a substantial misunderstanding of this executive order. This does not seem to create a policy whereby law enforcement can arbitrarily seize property owned by accused hackers. Asset forfeiture as a drug war tool is extremely problematic, and deserving of debate, but this is not that. Instead, this allows "the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State" to add a list of foreign hackers "located, in whole or in substantial part, outside the United States" to the "Specially Designated Nationals" list that Treasury maintains (at the Office of Foreign Asset Control). All US businesses, but especially financial institutions, who have an affirmative requirement to know their customers, have an obligation to not do business with entities listed on the SDN list. I am not a lawyer, but I have in the past written software intended to detect transactions by people on the SDN list. It is of finite length, it is publicly available for review, and individuals and businesses can only be added to it if an explicit decision is made at the cabinet level (as per my recollection). In general, I would think that HN would see this executive order as a good thing, because it will create a tool for the US to penalize criminal hackers that otherwise would be hiding in Russia, Iran or China. It is profoundly unlikely that these powers would be directed at any US persons, unless they were found to be dealing directly with the people enumerated on this public list.

anigbrowl 12y ago
The source article absolutely reeks of editorial bias, and does a very poor job of explaining the order itself, though at least it links to it. As you say, it's actually very narrowly tailored, and basically just grandfathers in cyberattacks against critical infrastructure as a type of terroristic activity.
enupten 12y ago
Would they hold property in the US if they weren't US citizens ? I mean, what's the point ? Can this be used against the Chinese defence manufacturers, who are rumoured to have benefitted from the attacks on Lockheed-Martin ?
- anigbrowl 12y ago
  Lots of people have property in the US without being citizens. You can set up a Delaware corporation online very cheaply. There are many legitimate reasons for doing so, like if you plan to expand your business into the US or you want to invest in a company listed on a US stock market. On the illegal side, lots of people try to use the US as a tax haven because it's surprisingly easy to obscure ownership through corporate structures. Also, money is important for both terrorism and espionage; a good deal of counter-espionage work consists of just investigating financial transaction metadata looking for unusual patterns. IIRC that was what led to the discovery of a Russian spy ring in NY a few years back.
iwwr 12y ago
Why is this list specially made for hackers and not all criminals hiding outside the US?
- deleted 12y ago
  [deleted]
- legutierr 12y ago
  To be placed on the list, a person (or vessel) would need to belong to a category specifically enumerated in an executive order such as this. Similar executive orders were crafted after 9-11 and during the drug war.
  - iwwr 12y ago
    I remember one such list was also created for people related to running poker and gambing sites outside the US.
j42 12y ago
To play devil's advocate, I think the point is how that "connection to entities on the SDN list" can be arbitrarily determined. Especially when digital channels are often source-agnostic and you could demonstrate "evidence-backed" relationships between two people who don't even know of each other's existence. In a court of law where technical misinformation abounds, this is not improbable. Imagine an individual on the SDN list has a fraudulent merchant account, which they use to receive and remit payments while obfuscating origin. These can often be mixed in with legitimate business, especially when the purpose is to avoid suspicious use patterns. Now, if you've in any way (knowingly or unknowingly) initiated a credit card transaction through such an account, that link is fully documented and "provable." No DA would press charges on something so baseless, but let's say you were a security researcher of some perceived value in finding the real target... they can, will and have been known to use whatever tactics are available to coerce desired behavior, with no concern to the aftermath; all of the power, with none of the messy aftermath/burden of proof that could affect a 99% conviction rate (ie, a trial). It's not so much the criminals they are currently seeking to apply this to, but those caught up in the dragnet of a system that doesn't fully understand technology, who are seen as a means to an end. This is but another tool they can use to exploit these people in the pursuit of that goal.
woah 12y ago
This is a forum full of the people that are on the frontline maintaining the businesses that would be harmed by these hackers. Maybe it's just that we know that most of the hysteria about hackers is bs.

anigbrowl 12y ago

The source article absolutely reeks of editorial bias, and does a very poor job of explaining the order itself, though at least it links to it. As you say, it's actually very narrowly tailored, and basically just grandfathers in cyberattacks against critical infrastructure as a type of terroristic activity.

enupten 12y ago

Would they hold property in the US if they weren't US citizens ? I mean, what's the point ? Can this be used against the Chinese defence manufacturers, who are rumoured to have benefitted from the attacks on Lockheed-Martin ?

anigbrowl 12y ago
Lots of people have property in the US without being citizens. You can set up a Delaware corporation online very cheaply. There are many legitimate reasons for doing so, like if you plan to expand your business into the US or you want to invest in a company listed on a US stock market. On the illegal side, lots of people try to use the US as a tax haven because it's surprisingly easy to obscure ownership through corporate structures. Also, money is important for both terrorism and espionage; a good deal of counter-espionage work consists of just investigating financial transaction metadata looking for unusual patterns. IIRC that was what led to the discovery of a Russian spy ring in NY a few years back.

iwwr 12y ago

Why is this list specially made for hackers and not all criminals hiding outside the US?

deleted 12y ago
[deleted]
legutierr 12y ago
To be placed on the list, a person (or vessel) would need to belong to a category specifically enumerated in an executive order such as this. Similar executive orders were crafted after 9-11 and during the drug war.
- iwwr 12y ago
  I remember one such list was also created for people related to running poker and gambing sites outside the US.

j42 12y ago

To play devil's advocate, I think the point is how that "connection to entities on the SDN list" can be arbitrarily determined. Especially when digital channels are often source-agnostic and you could demonstrate "evidence-backed" relationships between two people who don't even know of each other's existence. In a court of law where technical misinformation abounds, this is not improbable. Imagine an individual on the SDN list has a fraudulent merchant account, which they use to receive and remit payments while obfuscating origin. These can often be mixed in with legitimate business, especially when the purpose is to avoid suspicious use patterns. Now, if you've in any way (knowingly or unknowingly) initiated a credit card transaction through such an account, that link is fully documented and "provable." No DA would press charges on something so baseless, but let's say you were a security researcher of some perceived value in finding the real target... they can, will and have been known to use whatever tactics are available to coerce desired behavior, with no concern to the aftermath; all of the power, with none of the messy aftermath/burden of proof that could affect a 99% conviction rate (ie, a trial). It's not so much the criminals they are currently seeking to apply this to, but those caught up in the dragnet of a system that doesn't fully understand technology, who are seen as a means to an end. This is but another tool they can use to exploit these people in the pursuit of that goal.

woah 12y ago

This is a forum full of the people that are on the frontline maintaining the businesses that would be harmed by these hackers. Maybe it's just that we know that most of the hysteria about hackers is bs.