4 ms·

Is the current state of the law such that possession of these tools themselves is illegal? I would have thought that possession of most "hacking" tools would be

Is the current state of the law such that possession of these tools themselves is illegal? I would have thought that possession of most "hacking" tools would be legal i.e. for penetration testing and defense - usage against a non-consenting entity would then be the illegal act. I guess I could see some of the cell phone hacking stuff being illegal via FCC regulations...

dikaiosune 11y ago
Note that most of the convictions are for conspiracy to commit crimes or for selling tools expressly to commit them. Spam botnets, selling malware (probably advertised as a criminal tool), etc. While I didn't exhaustively read every charge, it looks like they're arresting people who either used said tools or profited from their criminal use. Didn't see anything related to "possession."
daveloyall 11y ago
Maybe, since April 1?? https://www.eff.org/deeplinks/2015/04/whitehouses-new-executive-order-cyber-crime-unfortunately-no-joke https://www.eff.org/deeplinks/2015/04/whitehouses-new-execut... IANAL...
- tptacek 11y ago
  Executive orders cannot create new prosecutable crimes. In this case, the EO exercises rulemaking delegated the President through the IEEPA, and is confined by the powers defined in the IEEPA, which governs foreign transactions.
tptacek 11y ago
I don't think so, no. I think they also need overt acts in furtherance of a conspiracy to use the tools. It's probably not as cut and dry as "you have to actually use the tools to break into someone". It's a bit of a tightrope, though, because if you're a predecessor on the graph of people involved in an actual crime, sharing tools can drag you into a prosecution. So far as I know (this is sort of my profession), there's no federal "burglars tools" law regarding malware.
- jjarmoc 11y ago
  > So far as I know (this is sort of my profession), there's no federal "burglars tools" law regarding malware. To be fair, many "burglars tools" laws require possession of the tools WITH INTENT to perform a criminal action. The intent piece is key. Merely possessing lock picks is usually fine. But sulking around masked in bushes outside an office building with a pickset, rope, and an empty duffel bag might get you in trouble. A good list of Lockpick laws collected and indexed state-by-state at http://toool.us/laws.html http://toool.us/laws.html. You see that in most jurisdictions intent is required. While malware laws are still much less mature, I would hope that similarly there'd be an intent requirement. Possessing malware for purposes of reverse engineering to develop protections is obviously important, and clearly an activity we would want to remain lawful (and hopefully unlicensed/regulated). Conspiracy is probably the easier route to a conviction.

dikaiosune 11y ago

Note that most of the convictions are for conspiracy to commit crimes or for selling tools expressly to commit them. Spam botnets, selling malware (probably advertised as a criminal tool), etc. While I didn't exhaustively read every charge, it looks like they're arresting people who either used said tools or profited from their criminal use. Didn't see anything related to "possession."

daveloyall 11y ago

Maybe, since April 1?? https://www.eff.org/deeplinks/2015/04/whitehouses-new-executive-order-cyber-crime-unfortunately-no-joke https://www.eff.org/deeplinks/2015/04/whitehouses-new-execut... IANAL...

tptacek 11y ago
Executive orders cannot create new prosecutable crimes. In this case, the EO exercises rulemaking delegated the President through the IEEPA, and is confined by the powers defined in the IEEPA, which governs foreign transactions.

tptacek 11y ago

I don't think so, no. I think they also need overt acts in furtherance of a conspiracy to use the tools. It's probably not as cut and dry as "you have to actually use the tools to break into someone". It's a bit of a tightrope, though, because if you're a predecessor on the graph of people involved in an actual crime, sharing tools can drag you into a prosecution. So far as I know (this is sort of my profession), there's no federal "burglars tools" law regarding malware.

jjarmoc 11y ago
> So far as I know (this is sort of my profession), there's no federal "burglars tools" law regarding malware. To be fair, many "burglars tools" laws require possession of the tools WITH INTENT to perform a criminal action. The intent piece is key. Merely possessing lock picks is usually fine. But sulking around masked in bushes outside an office building with a pickset, rope, and an empty duffel bag might get you in trouble. A good list of Lockpick laws collected and indexed state-by-state at http://toool.us/laws.html http://toool.us/laws.html. You see that in most jurisdictions intent is required. While malware laws are still much less mature, I would hope that similarly there'd be an intent requirement. Possessing malware for purposes of reverse engineering to develop protections is obviously important, and clearly an activity we would want to remain lawful (and hopefully unlicensed/regulated). Conspiracy is probably the easier route to a conviction.