Slashdot Mirror

Full disclosure debate.

There's an entire full disclosure debate bibliography.

There's an entire bibliography of the full disclosure controversy.

There's a good biblbiography of the full disclosure debate that will point you to many, many arguments.

My personal favorite was a big study of many CERT reports which concluded that the practical window of vulnerability begins when the first automated exploit code hits the street and ends only when attackers lose interest. Practically speaking, not enough people install patches to affect the dynamics. You do, I do, my clients do, everyone who listens to us does, but think of all the worms and spyware that have exploited vulnerabilities that had been patchable for months.

Paul Clark's full disclosure debate bibliography doesn't seem to have anything from 2005 but has most of the important articles on the subject.

Political News from Wired News - Cybercrime Treaty Finally Ready. After four years of haggling over the language, several countries including the United States will sign a cybercrime treaty.

WildernessCoast.org - Cybercrime Treaty Bibliography -- By Date. A wide collection of links that talk about the Cybercrime Treaty Same info sorted by title.

Council of Europe - Convention on Cybercrime.

The Convention on Cybercrime has been adopted by the Committee of Ministers during its 109th Session, on 8 November 2001 and will be opened for signature, in Budapest, on 23 November 2001.

The Convention will be the first international treaty on crimes committed via the Internet and other computer networks, dealing particularly with infringements of copyright, computer-related fraud, child pornography and violations of network security. It also contains a series of powers and procedures such as the search of computer networks and interception.

Its main objective, set out in the preamble, is to pursue a common criminal policy aimed at the protection of society against cybercrime, especially by adopting appropriate legislation and fostering international co-operation.

The Convention is the product of four years of work by Council of Europe experts, but also by the United States, Canada, Japan and other countries which are not members of the organisation.

It will be supplemented by an additional protocol making any publication of racist and xenophobic propaganda via computer networks a criminal offence.

[ ... ]

But Fred Eisner, a consultant for the Dutch government and private companies, said the draft made unfair demands on Internet service providers by asking them to track Web users' online movements.

"This draft convention lacks balance," Eisner told the assembly. "The convention explicitly gives much more power to law enforcement agencies and it has no system of checks and balances."

Bruce McConnell, president of McConnell International, a Washington-based consulting firm, said the treaty should be more forceful in protecting the privacy of Web users who are already worried about being spied on.

"There is concern that the powers of surveillance ... are not balanced by comparable protections for individuals' privacy," he said.

Maybe you trust the law-enforcement chiefs in D.C. to do the right thing. But here's the catch. The same new powers given to the United States will also handed over to Bulgaria, Romania, Azerbaijan, and other Council of Europe nations that-although officially democratic now-don't have a strong traditions of checks and balances on police power.

Do you want investigators rummaging around your clients' computer systems on warrants issued by former Soviet bloc nations?

That's the prospect that has pushed AT&T Corporation and other high-technology companies into feverishly trying to stop or at least soften the treaty. The U.S. Chamber of Commerce and Information Technology Association of America also oppose it.

Stewart Baker is one of the chief lobbyists for the treaty opponents. As a former general counsel of the National Security Agency and recipient of the Department of Defense Medal for Meritorious Civilian Service, he's got street cred on these issues in corporate America.

What worries Baker and his colleagues? Consider the following hypothetical: A Los Angeles screenwriter corresponds by e-mail with a neo-Nazi in Germany while researching a script. Shortly after, he finds federal agents examining the files on his home computer. The agents also visit America Online Inc. to retrieve records of the screenwriter's AOL usage.

The agents are fulfilling a warrant issued by German authorities allowing them to search for Nazi propaganda. Such material is unlawful in Germany but not in the U.S. They framed their warrant in terms of "suspected terrorist activity."

LAW.com (requires cookies) - International Treaty on Cybercrime Poses Burden on High-Tech Companies.

Maybe you're a civil libertarian, and maybe you're not. Maybe you worry about how the United States exercises its vast investigative and prosecutorial powers, and maybe you don't.

But if you counsel U.S. corporations on computer-related issues, you should be concerned about a new proposed treaty known as the "Convention on Cybercrime." The Council of Europe, a 43-nation public body created to promote democracy and the rule of law, is nominally drafting the treaty. Curiously, however, the primary architect is the U.S. Department of Justice.

The Department of Justice and Federal Bureau of Investigation are using a foreign forum to create an international law-enforcement regime that favors the interests of the feds over those of ordinary citizens and businesses. Their goal is to make it easier to get evidence from abroad and to extradite and prosecute foreign nationals for certain kinds of crimes.

Maybe you trust the law-enforcement chiefs in D.C. to do the right thing. But here's the catch. The same new powers given to the United States will also be handed over to Bulgaria, Romania, Azerbaijan, and other Council of Europe nations that -- although officially democratic now -- don't have a strong tradition of checks and balances on police power.

[ ... ]

Stewart Baker, a partner at Washington, D.C.'s Steptoe & Johnson, is one of the chief lobbyists for the treaty's opponents. As a former general counsel of the National Security Agency and recipient of the U.S. Department of Defense Medal for Meritorious Civilian Service, he's got street credentials on these issues in corporate America.

Slashdot | Implications Of The International Cybercrime Treaty.

SiliconValley.com part of San Jose Mercury News - Pioneer cybercrime pact tightens privacy rules.

MS-NBC - Pioneer cybercrime pact tightens privacy rules. PARIS, May 25 -- Stiff criticism from the EU and pressure groups has prompted drafters of the world's first treaty against cybercrime to tighten provisions protecting privacy online, the final text showed Friday.

[ ... ]

Against EU objections, it also limits the right of a country to reject a request from abroad to store and hand over data in potential crime cases if the requesting country thinks it could be misused.

The text says states should make sure that systems operators or other people who know how to use a certain system can be ordered to cooperate in any such a cyberprobe.

PARIS (Reuters) - Stiff criticism from the EU and pressure groups has prompted drafters of the world's first treaty against cybercrime to tighten provisions protecting privacy online, the final text showed on Friday.

The Council of Europe, a 43-state human rights watchdog, has amended the text to ensure police respect privacy rights when they follow digital trails to fight online crimes such as hacking, spreading viruses, using stolen credit card numbers or defrauding banks.

''The guarantees in the treaty have been reinforced,'' Peter Csonka, deputy head of the economic crime division at the Council's headquarters in Strasbourg, told Reuters after the Council posted the final text -- version 27 -- on its Web site.

But the treaty, which has aroused heated debate in cyberspace since its draft text became public last year, ignored calls by Internet service providers (ISPs) for fewer costly requirements on preserving data that could be linked to a crime.

It still accorded police wide powers to chase suspected cybercriminals -- powers some critics say go beyond what is legal in some Council member states or in observer countries like the United States, Canada and Japan due to sign the treaty.

ZDNet - Internet founder worried over EU cybercrime plans.

BRUSSELS --Vint Cerf, a founding father of today's Internet, said on Thursday that European Union plans for new rules to fight crime on the Web risked clashing with existing EU privacy regulations.

Cerf, who helped develop the Internet in the early 70s shortly after graduating from Stanford University and now works for WorldCom, said more secure network systems were an immediate priority for the successful development of the ubiquitous Web.

He told Reuters in an interview that Internet traffic should be retained only for billing purposes and was too cumbersome to be stored for police investigations.

Changes to a controversial treaty on cybercrime have done nothing to improve it, say civil liberty campaigners.

Next week, the Council of Europe will vote on the treaty, which has been redrafted 26 times before reaching its final version late in May.

The most recent changes were made to take into account the fears of civil liberty and privacy campaigners. But cyber-rights groups say the latest changes are purely cosmetic and have not diluted what they describe as its most pernicious sections.

The groups say that, if adopted in its current form, the treaty could lead to changes in legislation that would stifle rights to privacy and do little to curb the activities of law enforcement agencies.

[ ... ]

In December 2000, 23 organisations, banding together under the banner of the Global Internet Liberty Campaign (GILC), signed a letter condemning the 25th draft of the treaty as "appalling", and warned that it handed law enforcement agencies sweeping powers to snoop and could seriously erode online privacy.

Now, three civil liberty groups, the American Civil Liberties Union, the Electronic Privacy Information Center and Privacy International, have sent another letter to the Council of Europe outlining their "continuing concerns" over the wording of the treaty and saying that their fears have not been laid to rest.

The letter chastises the Council of Europe for refusing to open up the redrafting debates to non-governmental organisations and for, it says, ignoring the human rights and privacy concerns of organisations such as the GILC.

It goes on to say that the original criticisms still stand, and that the treaty does not pay enough attention to existing laws which safeguard human rights. It says the treaty's recommendations on protecting privacy are vague and do not go far enough.

IT industry gurus have branded the Council of Europe's Convention on Cybercrime 'foolish, unworkable and a legal con trick'.

The controversial treaty provides a blanket legislation to deal with all forms of internet crime from hacking to online pornography.

Caspar Bowden, director of internet think-tank FIPR, said: "The Convention is essentially a legal con trick, drafted in secret by a handful of nameless bureaucrats. It equates the internet - a network of private networks - with 'cyberspace', a metaphor from science fiction.

"By this sleight of hand, the internet is defined as a public space over which law enforcement should be granted unfettered powers of surveillance and extradition," he added.

International policy-makers this week ended a round of talks aimed at setting common rules affecting online trade and commerce, but they made little progress in bridging divisions that threaten to delay the pact.

In the works for nearly a decade, the Hague Convention on Jurisdiction and Foreign Judgments is still almost unknown outside international policy circles. Nevertheless, it could have broad implications for consumers and businesses by setting new rules for online copyrights, free speech and e-commerce--if it is approved.

Opposition to the treaty heated up Wednesday, when a two-week drafting session wrapped up with few concessions to critics, primarily from the United States, who say the pact threatens free speech and could force Internet service providers to become global content police.

"In a nutshell, it will strangle the Internet with a suffocating blanket of overlapping jurisdictional claims, expose every Web page publisher to liabilities for libel, defamation and other speech offenses from virtually any country, (and) effectively strip Internet service providers of protections from litigation over the content they carry," Jamie Love, director of Ralph Nader's Consumer Project on Technology (CPT), wrote in a report after the meeting.

The treaty is one of several efforts by the global community to grapple with a complicated legal issues on a borderless Web.

Four years ago, nations including the United States signed onto a World Intellectual Property Organization pact to protect copyright in the digital age. And several countries, including the United States, are hammering out the world's first cybercrime treaty, which would provide a standard for fighting online crime.

The Hague treaty differs from those efforts because it would not outline specific laws participants must follow. It's much broader, requiring participants to agree to enforce each others' laws on a variety of topics. As it stands, the treaty would require courts to enforce the commercial laws of the convention's 52 member nations, even if they prohibit actions that are legal under local laws.

BRUSSELS - The blueprint for a global code on Cyber-crime was agreed on in Strasbourg, France, Friday, paving the way for international rules governing online copyright infringement, online fraud, child pornography and hacking.

The 41 members of the Council of Europe (CoE), plus the U.S., Canada and Japan, signed on to a draft convention on cybercrime that is set to be rubber-stamped at ministerial level in September.

"Once adopted, the Convention will be the first international treaty on criminal offenses committed through the use of Internet and other computer networks," the Council of Europe said in a statement.

In September, the Council of Europe approved the Convention on cybercrime, a historic treatise that lays the foundation for legislation allowing for a greater sharing of information between countries to combat the rise of cybercrime.

The treatise isn't binding, but instead would have to be adopted into law by its 43 European member states and five outside countries including the United States, Canada and Japan.

The treaty is broad, covering crimes committed on the Internet such as fraud, child pornography and violations of computer network security. It also sets up global policing procedures for conducting computer searches, interception of e-mails, and extradition of criminal suspects.

More details on the CyberCrime Treaty can be found in the Privacy Digest archives dated September 26,2000, September 27,2000, October 09,2000, October 16,2000, October 18,2000, October 19,2000, October 25,2000, November 14,2000, November 20,2000, November 22,2000 and March 24,2001. This is not all the information at Privacy Digest and other sites so if you want to know more try a search

Political News from Wired News - Cybercrime Treaty Finally Ready. After four years of haggling over the language, several countries including the United States will sign a cybercrime treaty.

WildernessCoast.org - Cybercrime Treaty Bibliography -- By Date. A wide collection of links that talk about the Cybercrime Treaty Same info sorted by title.

Council of Europe - Convention on Cybercrime.

The Convention on Cybercrime has been adopted by the Committee of Ministers during its 109th Session, on 8 November 2001 and will be opened for signature, in Budapest, on 23 November 2001.

The Convention will be the first international treaty on crimes committed via the Internet and other computer networks, dealing particularly with infringements of copyright, computer-related fraud, child pornography and violations of network security. It also contains a series of powers and procedures such as the search of computer networks and interception.

Its main objective, set out in the preamble, is to pursue a common criminal policy aimed at the protection of society against cybercrime, especially by adopting appropriate legislation and fostering international co-operation.

The Convention is the product of four years of work by Council of Europe experts, but also by the United States, Canada, Japan and other countries which are not members of the organisation.

It will be supplemented by an additional protocol making any publication of racist and xenophobic propaganda via computer networks a criminal offence.

[ ... ]

But Fred Eisner, a consultant for the Dutch government and private companies, said the draft made unfair demands on Internet service providers by asking them to track Web users' online movements.

"This draft convention lacks balance," Eisner told the assembly. "The convention explicitly gives much more power to law enforcement agencies and it has no system of checks and balances."

Bruce McConnell, president of McConnell International, a Washington-based consulting firm, said the treaty should be more forceful in protecting the privacy of Web users who are already worried about being spied on.

"There is concern that the powers of surveillance ... are not balanced by comparable protections for individuals' privacy," he said.

Maybe you trust the law-enforcement chiefs in D.C. to do the right thing. But here's the catch. The same new powers given to the United States will also handed over to Bulgaria, Romania, Azerbaijan, and other Council of Europe nations that-although officially democratic now-don't have a strong traditions of checks and balances on police power.

Do you want investigators rummaging around your clients' computer systems on warrants issued by former Soviet bloc nations?

That's the prospect that has pushed AT&T Corporation and other high-technology companies into feverishly trying to stop or at least soften the treaty. The U.S. Chamber of Commerce and Information Technology Association of America also oppose it.

Stewart Baker is one of the chief lobbyists for the treaty opponents. As a former general counsel of the National Security Agency and recipient of the Department of Defense Medal for Meritorious Civilian Service, he's got street cred on these issues in corporate America.

What worries Baker and his colleagues? Consider the following hypothetical: A Los Angeles screenwriter corresponds by e-mail with a neo-Nazi in Germany while researching a script. Shortly after, he finds federal agents examining the files on his home computer. The agents also visit America Online Inc. to retrieve records of the screenwriter's AOL usage.

The agents are fulfilling a warrant issued by German authorities allowing them to search for Nazi propaganda. Such material is unlawful in Germany but not in the U.S. They framed their warrant in terms of "suspected terrorist activity."

LAW.com (requires cookies) - International Treaty on Cybercrime Poses Burden on High-Tech Companies.

Maybe you're a civil libertarian, and maybe you're not. Maybe you worry about how the United States exercises its vast investigative and prosecutorial powers, and maybe you don't.

But if you counsel U.S. corporations on computer-related issues, you should be concerned about a new proposed treaty known as the "Convention on Cybercrime." The Council of Europe, a 43-nation public body created to promote democracy and the rule of law, is nominally drafting the treaty. Curiously, however, the primary architect is the U.S. Department of Justice.

The Department of Justice and Federal Bureau of Investigation are using a foreign forum to create an international law-enforcement regime that favors the interests of the feds over those of ordinary citizens and businesses. Their goal is to make it easier to get evidence from abroad and to extradite and prosecute foreign nationals for certain kinds of crimes.

Maybe you trust the law-enforcement chiefs in D.C. to do the right thing. But here's the catch. The same new powers given to the United States will also be handed over to Bulgaria, Romania, Azerbaijan, and other Council of Europe nations that -- although officially democratic now -- don't have a strong tradition of checks and balances on police power.

[ ... ]

Stewart Baker, a partner at Washington, D.C.'s Steptoe & Johnson, is one of the chief lobbyists for the treaty's opponents. As a former general counsel of the National Security Agency and recipient of the U.S. Department of Defense Medal for Meritorious Civilian Service, he's got street credentials on these issues in corporate America.

Slashdot | Implications Of The International Cybercrime Treaty.

SiliconValley.com part of San Jose Mercury News - Pioneer cybercrime pact tightens privacy rules.

MS-NBC - Pioneer cybercrime pact tightens privacy rules. PARIS, May 25 -- Stiff criticism from the EU and pressure groups has prompted drafters of the world's first treaty against cybercrime to tighten provisions protecting privacy online, the final text showed Friday.

[ ... ]

Against EU objections, it also limits the right of a country to reject a request from abroad to store and hand over data in potential crime cases if the requesting country thinks it could be misused.

The text says states should make sure that systems operators or other people who know how to use a certain system can be ordered to cooperate in any such a cyberprobe.

PARIS (Reuters) - Stiff criticism from the EU and pressure groups has prompted drafters of the world's first treaty against cybercrime to tighten provisions protecting privacy online, the final text showed on Friday.

The Council of Europe, a 43-state human rights watchdog, has amended the text to ensure police respect privacy rights when they follow digital trails to fight online crimes such as hacking, spreading viruses, using stolen credit card numbers or defrauding banks.

''The guarantees in the treaty have been reinforced,'' Peter Csonka, deputy head of the economic crime division at the Council's headquarters in Strasbourg, told Reuters after the Council posted the final text -- version 27 -- on its Web site.

But the treaty, which has aroused heated debate in cyberspace since its draft text became public last year, ignored calls by Internet service providers (ISPs) for fewer costly requirements on preserving data that could be linked to a crime.

It still accorded police wide powers to chase suspected cybercriminals -- powers some critics say go beyond what is legal in some Council member states or in observer countries like the United States, Canada and Japan due to sign the treaty.

ZDNet - Internet founder worried over EU cybercrime plans.

BRUSSELS --Vint Cerf, a founding father of today's Internet, said on Thursday that European Union plans for new rules to fight crime on the Web risked clashing with existing EU privacy regulations.

Cerf, who helped develop the Internet in the early 70s shortly after graduating from Stanford University and now works for WorldCom, said more secure network systems were an immediate priority for the successful development of the ubiquitous Web.

He told Reuters in an interview that Internet traffic should be retained only for billing purposes and was too cumbersome to be stored for police investigations.

Changes to a controversial treaty on cybercrime have done nothing to improve it, say civil liberty campaigners.

Next week, the Council of Europe will vote on the treaty, which has been redrafted 26 times before reaching its final version late in May.

The most recent changes were made to take into account the fears of civil liberty and privacy campaigners. But cyber-rights groups say the latest changes are purely cosmetic and have not diluted what they describe as its most pernicious sections.

The groups say that, if adopted in its current form, the treaty could lead to changes in legislation that would stifle rights to privacy and do little to curb the activities of law enforcement agencies.

[ ... ]

In December 2000, 23 organisations, banding together under the banner of the Global Internet Liberty Campaign (GILC), signed a letter condemning the 25th draft of the treaty as "appalling", and warned that it handed law enforcement agencies sweeping powers to snoop and could seriously erode online privacy.

Now, three civil liberty groups, the American Civil Liberties Union, the Electronic Privacy Information Center and Privacy International, have sent another letter to the Council of Europe outlining their "continuing concerns" over the wording of the treaty and saying that their fears have not been laid to rest.

The letter chastises the Council of Europe for refusing to open up the redrafting debates to non-governmental organisations and for, it says, ignoring the human rights and privacy concerns of organisations such as the GILC.

It goes on to say that the original criticisms still stand, and that the treaty does not pay enough attention to existing laws which safeguard human rights. It says the treaty's recommendations on protecting privacy are vague and do not go far enough.

IT industry gurus have branded the Council of Europe's Convention on Cybercrime 'foolish, unworkable and a legal con trick'.

The controversial treaty provides a blanket legislation to deal with all forms of internet crime from hacking to online pornography.

Caspar Bowden, director of internet think-tank FIPR, said: "The Convention is essentially a legal con trick, drafted in secret by a handful of nameless bureaucrats. It equates the internet - a network of private networks - with 'cyberspace', a metaphor from science fiction.

"By this sleight of hand, the internet is defined as a public space over which law enforcement should be granted unfettered powers of surveillance and extradition," he added.

International policy-makers this week ended a round of talks aimed at setting common rules affecting online trade and commerce, but they made little progress in bridging divisions that threaten to delay the pact.

In the works for nearly a decade, the Hague Convention on Jurisdiction and Foreign Judgments is still almost unknown outside international policy circles. Nevertheless, it could have broad implications for consumers and businesses by setting new rules for online copyrights, free speech and e-commerce--if it is approved.

Opposition to the treaty heated up Wednesday, when a two-week drafting session wrapped up with few concessions to critics, primarily from the United States, who say the pact threatens free speech and could force Internet service providers to become global content police.

"In a nutshell, it will strangle the Internet with a suffocating blanket of overlapping jurisdictional claims, expose every Web page publisher to liabilities for libel, defamation and other speech offenses from virtually any country, (and) effectively strip Internet service providers of protections from litigation over the content they carry," Jamie Love, director of Ralph Nader's Consumer Project on Technology (CPT), wrote in a report after the meeting.

The treaty is one of several efforts by the global community to grapple with a complicated legal issues on a borderless Web.

Four years ago, nations including the United States signed onto a World Intellectual Property Organization pact to protect copyright in the digital age. And several countries, including the United States, are hammering out the world's first cybercrime treaty, which would provide a standard for fighting online crime.

The Hague treaty differs from those efforts because it would not outline specific laws participants must follow. It's much broader, requiring participants to agree to enforce each others' laws on a variety of topics. As it stands, the treaty would require courts to enforce the commercial laws of the convention's 52 member nations, even if they prohibit actions that are legal under local laws.

BRUSSELS - The blueprint for a global code on Cyber-crime was agreed on in Strasbourg, France, Friday, paving the way for international rules governing online copyright infringement, online fraud, child pornography and hacking.

The 41 members of the Council of Europe (CoE), plus the U.S., Canada and Japan, signed on to a draft convention on cybercrime that is set to be rubber-stamped at ministerial level in September.

"Once adopted, the Convention will be the first international treaty on criminal offenses committed through the use of Internet and other computer networks," the Council of Europe said in a statement.

In September, the Council of Europe approved the Convention on cybercrime, a historic treatise that lays the foundation for legislation allowing for a greater sharing of information between countries to combat the rise of cybercrime.

The treatise isn't binding, but instead would have to be adopted into law by its 43 European member states and five outside countries including the United States, Canada and Japan.

The treaty is broad, covering crimes committed on the Internet such as fraud, child pornography and violations of computer network security. It also sets up global policing procedures for conducting computer searches, interception of e-mails, and extradition of criminal suspects.

More details on the CyberCrime Treaty can be found in the Privacy Digest archives dated September 26,2000, September 27,2000, October 09,2000, October 16,2000, October 18,2000, October 19,2000, October 25,2000, November 14,2000, November 20,2000, November 22,2000 and March 24,2001. This is not all the information at Privacy Digest and other sites so if you want to know more try a search

Interesting how only the powers that be should now be allowed to eavesdrop and crack into computer systems, even though they're so intent on making it illegal for everyone else.

It's too bad that we have to trust a bunch of mostly technologically uninformed politicians to draft law these days. I'm sure their intentions are all good in trying to prevent terrorism, but sadly they've been duped, like much of American society, into believing that government can provide us with safety and security in all aspects of life. Unfortunately, in this effort to provide a safe and secure country, our liberties are getting trampled on in the process.

I have posted a bibliography of past articles that relate to the Cybercrime Treaty.