Slashdot Mirror
Gov Says Existing Laws Enough to Fight Cybercrime
pluteus_larva writes "According to this CNN story, an interagency report released by the Clinton administration claimed there is no need for new laws to prosecute the bad guys. Apparently lots of "top industry executives" were involved in the outcome of the report; Janet Reno was flanked by Commerce Secretary William Daley and some lawyer from AOL at the press conference where the report was released. "
Rob Malda is selling us out. I found these following cookies that slashdot stores:
religion
soc_sec_num
mothers_maiden_name
income_bracket
sexual_orientation
You guys can mod me down for being Off-Topic all you want. I don't give a damn about karma. I want an answer as to why those cookies are being stored and where Rob Malda is getting the information. You people need to know this. Don't blindly mod me down without thinking about the ramification.
Hates people who have stupid little sigs
Let's not prosecute or even investigate internet attacks, we might find out that China is the one committing the crimes. We wouldn't want anyone to limit Clinton's second income. Of course we do need at least a billion more gun laws that don't do anything.
This may be a good thing. I'd rather have no new laws than a law that is poorly thought out and just gives federal people a legal justification to invade my privacy.
'I ain't a liar, baby, and I ain't proud I just want what I'm not allowed.' -- Violent Femmes, 36-24-36
Hmmm. It's nice to see that the americans are starting to come to their senses about the web - it is good, it is big, but it is essentially another form of communication, like telephones and post, and can be dealt with accordingly. :+)
I *would* question their assumption that all web-criminals are also likely to be american though - not only is it insulting to americans, but may lead law enforcement into a false sense of security - give it to the FBI, they will track down the varmit no matter which state he hides in
--
-=DaveHowe=-
I still maintain that the government should leave the Net alone. If there are no laws to let lax security administrators have the post-coital satisfaction of having skr1pt k1ddy5 hanged, at least we don't have to, say, have equal racial representation in every photo posted in a corporate website. Government intervention, like stuffing a hamster up your own ass, seems like a good idea intially, and can even feel good for a moment, but when the beast goes crazy it's a world of pain and sadness...
Carefree highway, let me slip away on you.
Now, all we have to do is hope the government takes this report seriously.
Once they've stopped making bad new laws, they can work on fixing the bad old laws, so that they catch the bad guys without interfering unnecessarily with the good guys (which they do now).
It's not as much of a good step as, say, repealing UCITA and declaring all mandated filtering unconstitutional, but it's a good step nonetheless.
You know, its funny, really, that government thinks there are enough laws to fight cybercrime. I'm sure that this isn't a statement about the laws that exist, but a statement about the ones that don't. Does anyone know of good laws that fight cybercrime without throwing privacy out the window? Neither does government, and this is just a reflection of that. Punishment is certainly harsh enough, when someone who just mentions an attack can make front page world news.
-- Moondog
All of this government talk has me more than a little bit concerned.
A lot of this legislation is completely misguided, and often rooted in the hands of people who are completely clueless about what they are talking about in this area.
Many of the government's decisions in relation to anything computer related of late have seemed irrational, misguided, and harmful. Much of which shows a high degree of paranoia, and a lack of knowledge about the subjects at hand.
I hate to see a politician stand up at a podium and spout about how our world is at the mercy of "hackers." Or how "dangerous" those damn DoS attacks were a couple of weeks ago.
If this doesn't stop, this world won't be a safe place for anyone, us in particular. We'll have big software corporations that can shut down our computer for not renewing a site license on their screensaver package, they already passed the ever damned UCITA in my state (Virginia), people will be able to seize my computer because my third cousin was suspected of using a banned encryption algorithm in his sappy love letters to his girlfriend, and in general, we'll take a nice smackdown every day and beg for more because everyone who votes will be too dumb to figure out what the hell any of this means, and they'll cry when someone says "HACKER."
Ok, this is probably a bit much. But still, even talking like this, and showing this much ignorance, and passing misguided laws that smack of a lack of understanding and paranoia... It just irritates me.
Eh...
Between the flaming and crusading did anyone notice that that's the opposite Reno said like yesterday:http://www.theregister.co.uk/000309-0000 11.html
The message on the other side of this sig is false.
.slashdot.org TRUE / FALSE 1238366381 religion 9588955.83171397
.slashdot.org TRUE / FALSE 1238367387 soc_sec_num 4333867.61695147
.slashdot.org TRUE / FALSE 1238374397 mothers_maiden_name 7192354.57945615
.slashdot.org TRUE / FALSE 1238374457 income_bracket 5040447.43720442
.slashdot.org TRUE / FALSE 1238374543 sexual_orientation 3360304.50649559
I don't know why slashdot would need these cookies. That's why I'm asking. I've sent Rob an email. I just wanted to give everyone else a heads up in case they have the same cookies.
Hates people who have stupid little sigs
I don't even consider their rejection of creating new legislation to be "putting their heads in the sand." It is not an unreasonable idea to try to apply the existing laws.
It's fairly silly when legislators make up new legislation (that will never be enforced) in order to make it look like they're doing something about a problem to which existing laws ( that are also not being enforced) already apply.
Add in appropriate levels of cynicism as needed...
If you're not part of the solution, you're part of the precipitate.
For this administration, there can never be too many laws. Just wait until Mr. Gore discovers that this beast he created is far too evil. I picture a McCain sort of moment at a town hall meeting, a mother in tears steps up to a microphone and tells the horrors her family went through because little Jimmy was on a chat room and some old guy sends them a nude picture of himself.
Then the Internet will be upgraded to the status guns and tobacco are today. Who cares if the Columbine boys broke some 20ish laws, or if the drug addict mom/uncle of the Michigan six year old would ever pay attention to laws? Politicians will get up to their podiums during this race and proclaim more laws to not be enforced. No report like this will live long when it's an election year.
mochaone is right..
I have the following cookies:
slashdot.org FALSE / FALSE ######### income_bracket #########.#########
slashdot.org FALSE / FALSE ######### high_school_gpa #########.#########
slashdot.org FALSE / FALSE ######### sexual_orientation #########.#########
slashdot.org FALSE / FALSE ######### mothers_maiden_name #########.#########
slashdot.org FALSE / FALSE ######### last_time_you_brushed_teeth #########.#########
slashdot.org FALSE / FALSE ######### soc_sec_num #########.#########
slashdot.org FALSE / FALSE ######### iq #########.#########
slashdot.org FALSE / FALSE ######### religion #########.#########
slashdot.org FALSE / FALSE ######### visa_num #########.#########
I can sort of understand the interests in my VISA #'s, and religion and stuff... But the last time I brushed my teeth is my own gosh-darned business Malda!!
-- What you do today will cost you a day of your life.
Shut up brain or I'll stab you with a Q-Tip. - Homer Simpson
You can read the DOJ report for yourself here. CNN is somewhat correct - it does say that "existing substantive federal laws appear to be generally adequate." However, it emphasizes the dangers to security posed by anonymity, and it does not shut the door on new laws.
We've got an archive of other related articles on our Law Enforcement Online page.
A. Keiper
Where I live, there is still a law that says if the Sherrif asks you to leave town, he must provide you with a horse with saddle and blankets, bedding, a weeks tack and a 30-30 rifle with 10 rounds of ammunition. Imagine trying to enforce that one!
New laws in the US just mean more people from outside the US will be hacking US servers. "But the FBI will haul their asses in." Yea right. Let's see the FBI arrest someone from Cuba, China, or Russia! *[Ooooh we're breaking US laws!] *translated from Mandarin
It's good to see they aren't going to waste their time with more laws that won't work. What they need to push are sites that deal with security! How to lock down those B2B servers!
"History doesn't repeat itself, but it does rhyme." Mark Twain
Freedom and Liberty have been known about for quite some time, but we've not been a free country very long. Civil rights were won in the sixties. That was not so long ago. We've been talking the talk for quite some time, but we've only started to tiptoe the walk of freedom.
The net is a new opportunity. We have a great idea, we take for granted that it is free. No, that is not quite the truth. We feel sorrow and anger when someone threatens are ideal perception of what the net is. There is nothing intrinsic about the net that makes it free. It was simply largly constructed by scientists and engineers who are used to free exchange of ideas and aren't quite the control freaks a lot of these well meaning normals are.
We'd rather be a free people than not. I think when asked, even many in the government would prefer that. I see a lot of anti-government posts here, and I get the feeling from their hostility they would rather have a government that they can yell at and be angry at than not. Strange to me. I don't like to be angry.
-coyo
--------------------------------------------------
I caught them a few months ago and realized they were a joke. I wrote CmdrTaco about it, and he said it was part of an April Fools joke. I figured everyone else knew about it and I just missed it till November.
Guess it was that obscure.
-- Ever notice that fast-burning fuse looks exactly the same as slow-burning fuse? I didn't... (Edgar Montrose)
The Wild West indeed. Allow me to extend your metaphor, Ms. Reno.
For many years before the West was Wild, Native Americans lived there in relative peace and harmony with the earth and each other. There was no money. There was no need for written laws. Then, profit-seekers, outcasts and jerks from the east decided to head west to seek their fame and fortune. When they arrived, they walked around the place like they owned it, imposing their laws and ideologies; taking more and more away from the native peoples, until the land was no longer theirs at all.
Sound familiar?
We were here first, Ms. Reno. The US government didn't need to pass any laws that were specific to the Old West. Just imposing existing US law then was enough to ruin it for the original residents. Now how does that saying about history repeating itself go?
I'd like laws that protect my personal information and privacy, yes some old laws cover this but they don't cover the scope or were not written with the abibity to transfer mass amounts of data with little effort.
I'd like laws that prosecute faulty software. Software that doesn't do what it's supposed to or does something more then it's supposed to. I'd like a law the outlaws net taxs, most net sales still use UPS or such, wouldn't be easier to tax them?
I'd like the laws to be enforced by the UN so there isn't any jurisdiction crap, if someone in the US steals credit cards from germany I'd like there to be just one jurisdiction it falls under, not multiple.
I'd like investigators to just copy my hard drive rather then impounding my computer, or atleast give me the dollar value of my equipment when it was impounded.
I'd like a law that says any crpto that can be cracked wasn't a good one in the first place and it's the corperation's problem for not protecting their data.
I'd like to own anything that resides on my computer, if I want to decompile a filtering software to see what it filters, I should be able to.
But most of all I'd like only as many laws as needed to protect the people on the net, not the corperations.
Does it bother anyone else that Reno has been touring with this "top AOL lawyer"? I dunno, I just get this mental image of a demonic figure standing in the shadows just to the rear-left, his eyes glowing a pale red...
I understand why AOL is interested in the prospect of new legislation, but to be making public appearances? Does the Administration think that this corporate poster-boy lends them some credibility or something? I'd feel better about seeing John Perry Barlow.
While old laws can be used to prosecute, what does need to happen is the laws need to be made uniform and not at the mercy of uninformed technophobes. If Johnny gets nabbed running script kiddie files on Corporate Server, then the punishment should be relatively uniform and reasonable.
I hate using a cliche, but take the Mitnik case. He got nabbed doing nasty things or having someone else's data. Yes, he should've gotten his peepee slapped. 3 years probation, requirement that he goes to school or secures gainful employment, and maybe 30 days in the local slammer. 4 years? Imbecilic.
I noticed that Ryan said he and his colleagues in the Information Technology Association of America are committed to working with the government "to balance the privacy interests" of users with the need to find "those who seek to abuse it." What about privacy abuses like Doubleclick's tactics? How about companies like Symantec secretly sending out data about your computer? (See previous story about Peacefire for details)
Someone up the thread noted that the FBI won't get involved when the theoretical loss was less than $40K. No wonder the losses are artificially inflated! I bet, though, that these companies that scream they lost millions will 'forget' to include the loss when they report their data to the FTC or shareholders, which is also illegal and against FTC regulations. As an example, I give you Sun Corporation... They said Mitnik ripped off millions, but did not report it to the FTC or shareholders. What happened? Not a damn thing.
As an aside, I am not a Mitnik fanatic, I just used the examples because I was familiar with them.
"First things first, but not necessarily in that order."
- Doctor Who
If you think about it, the only thing this "script kiddy" did, in the big picture, to your network was make it stronger. Sure, he made you work hard for a weekend, but, if you're network was weak enough to go down from this in the first place, it was going to happen eventually. And now, I'm sure, you got the network back up, and at sufficient enough strength to withstand the same kind of attack in the future.
That is true, and is what I pointed out to the client - 'you may be in a bit of a huff from this happening, but you are better from it.'
In this particular case I was brought in as a consultant by a nonprofit organization, so I didn't charge my usual rates. What really ticked me off was law enforcement's unwillingness to help a non-corporate entity solely because of a lack of sufficient financial damage. That's not what they're about - making money - but they were significantly crippled operationaly, and needy people were hurt by it.
As a side note, another aspect that pissed me off about the episode is why it happened: an older gentleman that does most of their tech stuff thought he would give linux a try as their file server in a windows environment and was delighted that he was able to get it configured and working by himself without much pain.... well, he simply had no idea that the red hat installation had opened up ports he just didn't need (or what a port is for that matter) and that by default it is pretty freaking insecure after installation. So he got a bad impression of linux. I explained that NT was flawed by a factor more, but it ticked me off a bit. Open bsd and linuxppc seem to have the right idea in having most services basically shut down until someone comes along and enables them. Mandrake, I've noticed, has a security level setup as part of their install - I hope to see this kind of thing become more of a standard....
This is utter and complete claptrap.
Indian cultures warred on each other with great ferocity. Indian agriculture resembled closely what we refer to as "strip farming".
In other words, they were real people with as many faults and warts as their European invaders, who were simply better armed.
Please folks, don't get your image of native Americans from John Wayne films.
Or are we supposed to call it "herstory" when it diverges this far from reality?
I don't think we know much about how well the native americans lived in
harmony with nature, but we do know that a few thousand years ago
newcomers came from the *west* and, as near as we can tell, killed them all
off. These newcomers came to be known as "Indians" when Columbus
thought he'd travelled to India. The name stuck, but modernly there
are folks calling this group "Native Americans."
This new group had a great many cultures, many of which were quite
different. Some were peacefull, licving with nature, etc. Others
were warlike, violent, and bloodthirsty. Some of these tortured
their captives, by such endearing methods as burning them alive to
test their bravery. Others enslaved other groups. Still others
exterminated others completely. The paths across the continent
of some of the warlike groups can still be traced by some of the
characteristics of the groups they displaced.
Eventually another group showed up from the east. These were more
warlike than some, and quite less warlike than other of the native
inhabitants. However, they were much better at war, and had better
weapons. They eventually ended up with most of the good land,
regardless of whether the peaceful or warlike groups previously held it.
Unless you get your history from political rallies, the American
Indians/Native Americans/whatever were rather diverse. The myth
about universally living in peace and harmony with nature is just
that, a myth. Some did, some didn't.
I work in network security for a large corporation, and the problem with the view that "hackers only point out weaknesses in your network, so you should thank them" is that they're exactly the people we need to keep out. This business of non-malicious vs malicious is not the point. Was the person authorized? No? Then it was wrong. Yes, I personally am glad they may not have had intent to do something further, since that means that there's less work to be done. But the fact that someone went somewhere they're not supposed to go is not excused by the fact that our security had a chink in it.
All that aside, authorized audits are a good thing. This way, you guarantee that they're not malicious (assuming you trust the auditors ;> ), and still find holes.
"You can never have too many elephants on your team."
Too late for karma but...
As I noted in a previous story's thread, The Register had an article about a General Accounting Office report that basically says the DOJ is going about this in entirely the wrong way because of turf concerns.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
Here's my checklist of what needs to be fixed:
Doing this will actually fix the problem. Much more effective than holding press conferences.
John Nagle
your browser does not generate cookies, servers do, so pull your opposable thumb from out of your ass, OR IS IT NOT POSSIBLE TO DO THAT?
And how would the server know? Well, have you followed the Doubleclick controversy? Do you have your own IP address, or do you share one with the rest of AOL? Because all of the cool people have their own IP address (I have 269 of them :), and when they go to Slashdot, and from there to somewhere else, read the story, back and post a comment... why, it does not take long to figure out who goes with which IP address if they're somewhat active. It's happening only rarely now, but all the records are accumulating, companies are merging... it's just not that far fetched.
Anyway, so the guy made a mistake. He's one out of thousands of people. If you've ever run a big mailing list or organized a big event (yeah, like your 10th birthday to infinity), you quickly come to realize that when 1000s of people are involved, just by probability alone a small number of perfectly intelligent people are going to miss the instructions, not see an obvious sign, etc. It's really no big deal. But when you make a big deal out of it when other people make a mistake, you then find yourself feeling especially humilated when you make a mistake yourself. Luckily, you still live with your mother and she can comfort you, but when you get big you'll realize that it's better to just explain things to people.
The reason behind the "no new laws" (or "not a lot of new laws") announcement has more to do with the Internet's enormous influence on the US economy than any respect for privacy. Passing more anti-privacy laws might slow down the nascent economic juggernaut that is the Internet and upset powerful corporations like Time-Warner/AOL. For that reason alone the gov't makes the claim that no new laws are needed.
But...
Just wait a few years until the Internet is even more established in the US economy and more people rely on it in their daily lives. Right now, many people in the US are still extremely worried about privacy and because of that do not shop online. The mega-corporations and the gov't hope that announcements like those of today will help bring about a change in this attitude. Once this is accomplished and there is a greater social acceptance of and reliance on the Internet, more and more anti-privacy laws will be proposed - most likely under the hypocritical guise of extending our privacy! The US government serves the interest of the large corporations - that's why Attoney General Reno was flanked by a "top lawyer from AOL" and not a top lawyer from the American Civil Liberties Union, who probably were not even consulted.
The USA has roughly 4% or the world's population and about 50% of the world's prisoners - the majority of which have been convicted of non-violent crimes. This speaks volumes for our tendency to want to solve every social problem by passing laws and putting people in jail. Unless we don't get complacent, it's only a matter of time before we lose what privacy we have left not only on the internet.
Prediction: within the next 10 years, some US state will arrest, convict and execute someone for violating new Internet laws.