Slashdot Mirror

Germany outlawed the ownership of "hacking tools" (202c StGB, "Acts preparatory to data espionage and phishing") , and all of a sudden, Internet security research in Germany is lagging.

Indeed but the treaty is just an extradition treaty and does not define *who* gets extradited. Specifically Germany is only allowed to extradite a non-citizen under the Article 16 of the German constitution. https://www.gesetze-im-interne... exception being extradition for final destination in an EU country, and extradition to appear in front of an international court.

The only German citizens who have ever been extradited have been war criminals and most of them didn't leave the EU.

Of course we do, if there is a solid case.

27 people have historically been extradited from Germany. Of those 15 were not German citizens and 12 were tried as war criminals and extradited by the Allies for their involvement in the international law.

You're German (I think) so I'm just going to link to you your own constitution without a translation. As a citizen you are only allowed to be sent to another EU state or to an international court.

Make no mistake, Martin Winterkorn will NOT be extradited to Germany, not for his current crimes in the USA, and not if he committed far worse ones.

Germany has the same rule, I think. Came as a surprise to us from Norway, but we crossed so far from traffic nobody fined us or anything. But then Germany is notorious for having rules for everything and actually sticking to them. It's kinda nice and incredibly frustrating at the same time, depending on what side of the stick you're on.

In Germany it depends, but is is not illegal to cross the road. The law is:

(3) Wer zu Fuß geht, hat Fahrbahnen unter Beachtung des Fahrzeugverkehrs zügig auf dem kürzesten Weg quer zur Fahrtrichtung zu überschreiten. Wenn die Verkehrsdichte, Fahrgeschwindigkeit, Sichtverhältnisse oder der Verkehrsablauf es erfordern, ist eine Fahrbahn nur an Kreuzungen oder Einmündungen, an Lichtzeichenanlagen innerhalb von Markierungen, an Fußgängerquerungshilfen oder auf Fußgängerüberwegen (Zeichen 293) zu überschreiten. Wird die Fahrbahn an Kreuzungen oder Einmündungen überschritten, sind dort vorhandene Fußgängerüberwege oder Markierungen an Lichtzeichenanlagen stets zu benutzen.

-- https://www.gesetze-im-interne...

Translation:
Someone walking on foot has to cross roadways, while heeding vehicle traffic, speedily on the shortest path perpendicular to driving direction. If the density of traffic, speed of traffic, visibility conditions, or the flow of traffic require it, a roadway must only be crossed at road intersections, at traffic lights, on the inside of markings, or at pedestrian crosswalks. If crossing the roadway at road intersections, any available pedestrian crossings or markings at traffic lights must be used.

I.e., you cannot simply cross just anywhere on a high-level road with dense, fast traffic (think Autobahn) or in really bad visibility like dense fog. But a road like in the accident video, even if it's dark, is just fine if there is no dedicated crossing nearby

Only those watches are banned that have a limited telephony function, with which the children (and also other people in its presence - like teachers, playmates, maybe even you) could also be monitored acoustically (this interception function will then be referred to as a "baby monitor" or "monitor function").

Remotely activated mobile phone (or watch) microphones are classified as illegal listening devices by Germany's Authority for Telecommunications, as Germany punishes "violations of the privacy of the spoken word" in its penal code.

Also: original source (in German).

https://www.gesetze-im-interne...

First of all, it has nothing to do with any radio licensing or bugs or hijacking, The description of what is forbidden is pretty clear:

die ihrer Form nach einen anderen Gegenstand vortäuschen oder die mit Gegenständen des täglichen Gebrauchs verkleidet sind und auf Grund dieser Umstände oder auf Grund ihrer Funktionsweise in besonderer Weise geeignet und dazu bestimmt sind, das nicht öffentlich gesprochene Wort eines anderen von diesem unbemerkt abzuhören oder das Bild eines anderen von diesem unbemerkt aufzunehmen.

Let's start from the back: The device has to be capable to record or transmit non-public speech or image unnoticed. Check. But that would be true for any phone or mp3-player, so there are some other required features: The device has to be either a) pretending to be another class of object or b) to be disguised with an everyday object or c) suitable and meant to facilitate secret recordings or transmissions.

We have a recording device that is hidden in a doll (everyday object). It transmits speech to a server. That's basically it. Even small changes, as local speech processing would let that doll of the hook, so comparisons to your other examples are academic exercises, as these aren't identical. Then lots of detail is lost in translation, like a subtle difference for audio and "images" (still or moving)

The case would be clear for Alexa: This device is not disguised and lights up when recording or transmitting. So nothing unnoticed.

The phone in the pocket.. well.. just say if you set it to record before putting it into your pocket, you would WISH that this law was used, because secretly recording someone is a criminal offense, while this here only calls for verified destruction of offending devices.

The microphone and camera in the Smart TV is a really interesting case. If you think actions should be taken, there is an email address to report suspicious devices.

And as a fun fact: it is not enough to attach a warning label to legalize hidden recording devices. Heck knows why. But we're talking about lawyers, so it's probably not heaven knows why....

Reference: 90 TKG

You claimed "germany has laws against insults towards politicians". Which sounds like a general rule towards all politicians.

Well, yes, that's what it is..

You have to accept that some countries have different ideas.

I fully accept that Germany is different from the US, which is why I like using Germany as a negative example for what the US shouldn't do.

Which I admitted in my first post.

Yeah, sure, whatever.

In Germany this can be found in https://www.gesetze-im-interne... under 89. Basically it says that you can only listen to open material that is meant for the public. If you accidentally listen to other things you are not allowed to publish them in any way. So a broadband receiver on the web would publish everything.

This is pathetic, maybe people should use encryption. Maybe if they only have a law to protect them, the information wasn't worth anything in the first place.

Section 95a (2) of the German copyright law defines specifically what an effective technological measure is. It specifically includes "encryption, scrambling or other transformation". It does not require that the encryption etc. need to be unbreakable, just as a physical lock does not have to pose an unsurmountable barrier in order to make breaking it illegal.

In Germany you can be punished with up to one year in prison for publishing a mugshot: http://www.gesetze-im-internet.de/kunsturhg/BJNR000070907.html http://dejure.org/gesetze/StGB/201a.html

...state-threatening act of violence.

Unless the model plane is the size of a 747 or the explosive is anit-matter, how is that a "... state-threatening act of violence." Is Germany in such dire straits that a single model aircraft can topple a whole country?

First of all: here is a difference between the "state" and a country.

Second: http://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html (Translation of the German Criminal Code provided by Prof. Dr. Michael Bohlander)

Section 89a

Preparation of a serious violent offence endangering the state

(1) Whosoever prepares a serious offence endangering the state shall be liable to imprisonment from six months to ten years. A serious violent offence endangering the state shall mean an offence against life under sections 211 or 212 or against personal freedom under sections 239a or 239b, which under the circumstances is intended to impair and capable of impairing the existence or security of a state or of an international organisation, or to abolish, rob of legal effect or undermine constitutional principles of the Federal Republic of Germany.

In the first place, I did not really mean to refer to the present case in writing the above post. Rather I was debunking in general the kind of legal chauvinism GP was entertaining. However, since you are interested in the law ...

Same here.. I just wanted to open that mentioned can of worms by providing another valid viewpoint, that would have led to the opposite conclusion.

To restate the facts: FB makes a Carbolic Smoke like "unilateral offer to the world." A minor (lacking in her jurisdiction the capacity to enter into contract) sitting in front of a computer in Italy purports toa ccepts the offer.

In my jurisdiction the "postal acceptance rule," which holds inter alia that a postal contract is made in the place from which the acceptance is sent , should be disposative of the question. Acceptance was made in Italy where user lacks capacity and thus no valid contract was entered into (and the choice of law clause which would have determined the proper law is non-effectual).

I'd question that....

Most "uniliteral offers to the world" are NOT seen as a binding offer, but rather an invitatio ad offernadum, an invitation to treat. I doubt that FB is obliged to accept anyone who tries to sign up. So this would exactly reverse your point: The OFFER would have been sent from Italy, but the ACCEPTANCE wherever the FB branch responsible for the European part of the site might be. (IIRC, FB claims that to be Ireland, but for the sake of the argument it could also be the US)

That would put that whole stuff under US Law, COPPA and so on.

In Italy ... in Italy. As a common-law lawyer I have no freeping idea! I mean, what the hell are these Italians on about? I would have thought if she lacked the capacity there never was a contract, so how can they go after FB for "entering into a contract with a minor?!!!" Or is this poorly translated?

At least oversimplified. I doubt any jurisdiction could ban minors completly from contracts, or else they couldn't do as much as buy an ice cream or a coke on their own. For example, 110 BGB is the law that adds that exception to the general "no contracts with minors" rule. (probably like COPPA allows minors to sign up to websites)

So that italian girl did business with an american website....

... in Italy. Whether I buy a can of Coke or a can of Ozzie Cola in Australia the same Australian law will apply.

But this is where the analogies end: If a minor from italy can get to Australia to buy a softdrink without her parent's consent, we have a completly other matter at hand...

Another poster claimed that Metro AG actually also got a trademark of the class that includes computer software. No idea if they are using it or if Germany has a "use it or lose it" stance on trademark as in the US.

If you still don't use your trademark after five years since its registration have gone by it can be deleted according to German law (citation (German)).

You can now get a larger punishment for sharing copies than for killing someone.

Someone? Make that millions. In Germany, causing a nuclear explosion results in the same maximum jail time (5 years) like sharing copies.

Granted, the later is the sentence for doing it "commercially". But that doesn't mean you need to make millions off of it. Given past court (German) rulings, running Google Ads on your otherwise private site or similar little things might be enough to make it a formal business(-like) venture.

You can now get a larger punishment for sharing copies than for killing someone.

Someone? Make that millions. In Germany, causing a nuclear explosion results in the same maximum jail time (5 years) like sharing copies.

Granted, the later is the sentence for doing it "commercially". But that doesn't mean you need to make millions off of it. Given past court (German) rulings, running Google Ads on your otherwise private site or similar little things might be enough to make it a formal business(-like) venture.

Ok. This means that the Bundesverfassungsgericht (Constitutional Court) of Germany is wrong too, because the Zensurverbot in section 5 of the German Grundgesetz means exactly that: Censorship is the control of any media before publishing it.

So you have not only to convince me, but also the german Constitutional Court.

Twitter-level knowledge does not entitle one to spread bullshit around.

You are talking about Â86 StGB, though you've almost certainly never heard about nor read it.

There is extensive literature on the reasoning behind, the legality of and the exceptions allowed by this Â. It is not that the shape is illegal. In fact, to this day you find the symbol in all kinds of places, embedded in architecture and the like. No one has ever gone to clean it up. It is also in public display at museums, in history books, etc. etc. etc.

But, you know, we kind of felt like not wanting to have the symbols of an evil cult that caused the death of some 50 mio. or so people around. The guys who wrote the law knew about trolls even though the Internet wasn't yet invented.

It's a good law and very few people inside Germany would want it removed. And to the best of my knowledge, nobody who isn't a Nazi has ever been convicted on it.

Oh, and before you start the usual bullshit about how the USA is so much better and has Free Speech, you should know one more detail about german history: Those early laws of the modern Germany were written shortly after the war, and were massively influenced by the Allies, mostly the Americans.

In Germany we have this fine law:

Defamation of the President of the Federation

(1) Whosoever publicly defames the President of the Federation, in a meeting or through the dissemination of written material (section 11 (3)) shall be liable to imprisonment from three months to five years.

(2) In less serious cases the court in its discretion may mitigate the sentence (section 49 (2)) unless the conditions of section 188 are met.

(3) The penalty shall be imprisonment from six months to five years if the act constitutes an intentional defamation (section 187) or if the offender by the act intentionally supports efforts against the continued existence of the Federal

Republic of Germany or against its constitutional principles.

(4) The offence may only be prosecuted upon the authorisation of the President of the Federation.

In german law the copyright on the aggregate does not cover the individual parts, but the decisions to aggregate them in a certain way. (Like which parts to include, how to order them, etc.). http://www.gesetze-im-internet.de/urhg/__4.html
In principle you can have a copyright on that without holding the copyright or a license for the individual parts. You would have no right to distribute the aggregate, because you need a license to the individual parts. But you could prevent someone else (who might have these licenses) from distributing an identical aggregate without licensing the aggregate format from you.

Practically usually the aggragation is too primitive to be considered a work in the sense of the law, and I doubt that AVM meets this theshold with their distribution.

BUT: From the article it is clear, that Cybit does not distribute an aggregate. It modifies a part of an aggregation. They could try to invoke 14 of the law, which allows a creator to prevent modifications under certain conditions. http://www.gesetze-im-internet.de/urhg/__14.html
But I do not think that holds, as Cybit is only modifying the parts, which are not AVM copyright. The aggregation is kept intact. (At least I don't see any reference to parts of the software beeing removed or software added)
Also, the modification by Cybit are unlikely to exceed the threshold set by 14 UrHG.

In german law the copyright on the aggregate does not cover the individual parts, but the decisions to aggregate them in a certain way. (Like which parts to include, how to order them, etc.). http://www.gesetze-im-internet.de/urhg/__4.html
In principle you can have a copyright on that without holding the copyright or a license for the individual parts. You would have no right to distribute the aggregate, because you need a license to the individual parts. But you could prevent someone else (who might have these licenses) from distributing an identical aggregate without licensing the aggregate format from you.

Practically usually the aggragation is too primitive to be considered a work in the sense of the law, and I doubt that AVM meets this theshold with their distribution.

BUT: From the article it is clear, that Cybit does not distribute an aggregate. It modifies a part of an aggregation. They could try to invoke 14 of the law, which allows a creator to prevent modifications under certain conditions. http://www.gesetze-im-internet.de/urhg/__14.html
But I do not think that holds, as Cybit is only modifying the parts, which are not AVM copyright. The aggregation is kept intact. (At least I don't see any reference to parts of the software beeing removed or software added)
Also, the modification by Cybit are unlikely to exceed the threshold set by 14 UrHG.

No, it is the opposite around: I get just one factually false statement after another from you,

Like what?

Then disprove it. Bring me one singel case where emails where accessed legally without court order.

I gave you the law:

http://www.gesetze-im-internet.de/g10_2001/BJNR125410001.html

Here are some newspaper analyses:

http://www.sueddeutsche.de/politik/entwicklung-der-sicherheitsgesetze-viele-jaeger-sind-der-freiheit-tod-1.377313

http://www.welt.de/politik/article1589067/BND_darf_Telefonate_von_Verdaechtigen_abhoeren.html

If you dig a little deeper, you'll see that the BND routinely monitors international calls (from their facility in Pullach). It's neither a secret or a great mystery. And they did the same thing back in the 1970's and 1980's for calls to/from East Germany. The have general authority to do that and don't need a court order for each instance. God only knows what the German "Verfassungsschutz" does.

In 20+ years of living in Germany, only once have the police requested an ID from me.

Same with me - in over 2 years I've never been asked for ID, doesn't change the fact that the law applies to foreigners like us as well.

It's not ideological, rather empirical. My girlfriend (state insured) had an allergy problem, and had to first go to her General Praticioner (Hausartz) to get a referral to an allergy specialist, who did a set of allergy tests. Since they all came up negative, the doctor needed to do another set of tests. Oh, but the state insurance only allows one set of tests per calender quarter. "Sorry, come back in two months." As a private insured patient, the doctor can do whatever is necessary, whenever it is necessary. Recently there was something in the news about how dentists had used up all their allotment for treatments, so they were telling people to come back in January. No, thanks.

Private insurance has all sorts of exceptions and limitations such as 'will only pay X number of these treatments per year', 'will only pay X% of the cost of this' too. It's better for some people's circumstances (me included) but not automatically better than the public system.

The bills get sent directly to me. I pay the bills myself directly. It is my responsibility to do the paperwork, and submit that to the insurance company. They reimburse me then directly. So to reiterate, no 'tracking data' is sent from my doctor to the health insurance company; they only get what I choose to send them.

The types information that can be stored on a health insurance card are set down by Germany's data protection laws:
http://www.gesetze-im-internet.de/sgb_5/__291a.html

There's no secret 'tracking data'. Plus with private insurance you have no choice what you can send or not - you have to send exactly what the insurance company requires of you.

Wow. You know, I thought you were just overinterpreting the law or being paranoid, but I checked, and you're right. Here's the relevant paragraph, and here's the German Wikipedia's entry on what constitutes a "protective weapon".

Apparently, you can receive up to one year in prison for bringing (read: wearing) one, too.

Amazing, and not in a good way.

Paragraph 166 StGB (translated): Whosoever publicly or through dissemination of written materials (section 11 (3)) defames the religion or ideology of others in a manner that is capable of disturbing the public peace, shall be liable to imprisonment of not more than three years or a fine. Whosoever publicly or through dissemination of written materials (section 11 (3)) defames a church or other religious or ideological association within Germany, or their institutions or customs in a manner that is capable of disturbing the public peace, shall incur the same penalty.

More blasphemy laws at Wikipedia.

Those that just out and out steal (yes it is appropriate, because it means taking something without paying, regardless of the lack of a physical item taken).

It is still inappropriate, because it is not taking. It is copying. Physical item or not (I agree that is immaterial, pun intended) the important difference is whether or not the original owner is left with or without his original.

Stealing is actually legally defined (at least in my country) not as taking, but as "taking away" (precisely, "taking away with the intent to make your own", but that's nitpicking). If you are not "taking away", then it is not stealing in the legal sense.

Here's the legal reference, if you can read german: http://www.gesetze-im-internet.de/stgb/__242.html

Sources would be the BDSG (Bundesdatenschutzgesetz). Personal data of a special nature (religious affiliation is of that kind, specifically mentioned) gets even more protection.

http://www.gesetze-im-internet.de/bdsg_1990/BJNR029550990.html

In 14(2)(6), 14(2)(7), and 14(5)(1), that law effectively permits the use personal data collected by any government agency for police purposes, including highly personal information, like religion and sexuality. That's in addition to several other loopholes in that law that would make it possible for that data to be shared.

As for having something to prove; nope, Germany doesn't.

Whether other people trust Germans on issues of democracy, privacy, and freedom is not for Germans to decide, it's something Germans need to convince other people of. You aren't doing a good job, and I'm not convinced.

it does beat at least the spreader of democracy in the middle east

I don't see what those points have to do with anything. We're talking about whether a German government representative has much credibility when making statements about privacy and free speech, and I don't think he does, based on Germany's actual privacy situation.

As for US foreign policy, the responsibility of US politicians is to US voters alone. When the US "spreads democracy" (as it did in Germany and Japan), it's to serve US interests, nothing more.

You recently learned wrong, however. It doesn't matter whether DTAG or Deutsche Post are private enterprises or not; article 10 still applies. Without a law allowing it or a corresponding court order, government officials still cannot go to the Post, open your letters and read them. Article 10 still prevents them from doing that. The German state remains a substantial shareholder in both DTAG and Post, as well. Also, even the private enterprise Deutche Post (and its competitors) are bound by the Postgesetz (as is the DTAG and its competitors by similar laws) which codifies pretty much the same -- i.e. even the private enterprise Post cannot legally read your mail or collect information on your mailing behavior. (See 39 PostG, for instance).

Furthermorse, it's not article 10 that is in question here -- it's the BDSG. We don't need case law for what you describe to still be illegal; the BDSG is pretty clear on what it considers personally identifiable data. While no case law exists, judges are still free to look at other decisions and interpretations.

"I'm pretty confident that 'regular' logging will continue to be alright; the analysis of user behavior is the critical fact here, at least that's how I read it." -- how you read what ? Have you READ the BDSG ? Have a look at http://www.gesetze-im-internet.de/bdsg_1990/index.html ... Analysis of user behavior is not a valid reason to log personally identifiable information as per the law.
There's an old saying "Wo kein Kläger da kein Richter", though. People don't usually sue Joe Sixpack Webmaster about this stuff.

Some laws proposed recently are silly, I agree. The BDSG is not one of them. The now infamous Hackergesetz, however, is.

No, I think the BDSG is more relevant here:

http://www.gesetze-im-internet.de/bdsg_1990/

But you're right, this ruling only applies to this case: a public entity. Private entities have completely different rules.

(3) Bildträger, die nicht oder mit "Keine Jugendfreigabe" nach 14 Abs. 2 von der obersten Landesbehörde oder einer Organisation der freiwilligen Selbstkontrolle im Rahmen des Verfahrens nach 14 Abs. 6 oder nach 14 Abs. 7 vom Anbieter gekennzeichnet sind, dürfen 1.einem Kind oder einer jugendlichen Person nicht angeboten, überlassen oder sonst zugänglich gemacht werden,

A quick Goole for "Privatkopie" brought up a lot of Reference, but only in German I'm afraid ;-)

E.g. http://www.privatkopie.net/ who try to make shure it stays that way.

The law itself is 53 UrhG : http://www.gesetze-im-internet.de/urhg/__53.html

It's basicly that you are allowed to make "some" copies of copyrighted material you own, as long as you don't make money with it. Most courts have draw the line of "some" at five or so.