Slashdot Mirror
U.S. And EU Ready International Cybercrime Treaty
Nightspore writes: "Yes, while you slept last night another supra-governmental body was hard at work readying a shiny new set of chains for you. Read more on how the US and EU are putting the finishing touches on their international cybercrimes treaty. The treaty will force all signatories (i.e. your government) to make illegal the 'import and distribution of devices used for hacking.' Signatories also would be required to 'provide law enforcement authorities with the ability to conduct computer searches and seize computer data.'
"
Cool! Where do we sign?
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
The Council of Europe is, therefore, more far-reaching than the EU as it includes all of those countries that didn't join the EU (like Norway). Even Moldavia and Liechtenstein are on the Council.
So, essentially, this is even worse that you might have thought. There is pretty much no "western data haven" to work from.
--
www.kitchengeek.com -- Nosh for
No way do I believe that the Supreme Court would hold that a treaty overrides the Constitution. However, I sure wouldn't mind an amendment which holds the limitations the Constitution places on our government, and the rights and privileges recognized thereunder, override the terms of any and all treaties which are to the contrary. Even freedoms need backups.
--
Build a man a fire, and he's warm for a day.
Time is Nature's way of keeping everything from happening at once... the bitch.
Treaties do not supercede the constitution, as it, and only it, is the supreme law of the land.
Article 1, Section. 10,Clause 1: No State shall enter into any Treaty, Alliance, or Confederation; grant Letters of Marque and Reprisal; coin Money; emit Bills of Credit; make any Thing but gold and silver Coin a Tender in Payment of Debts; pass any Bill of Attainder, ex post facto Law, or Law impairing the Obligation of Contracts, or grant any Title of Nobility.
Article 2, Section 2, Clause 2: He shall have Power, by and with the Advice and Consent of the Senate, to make Treaties, provided two thirds of the Senators present concur; and he shall nominate, and by and with the Advice and Consent of the Senate, shall appoint Ambassadors, other public Ministers and Consuls, Judges of the supreme Court, and all other Officers of the United States, whose Appointments are not herein otherwise provided for, and which shall be established by Law: but the Congress may by Law vest the Appointment of such inferior Officers, as they think proper, in the President alone, in the Courts of Law, or in the Heads of Departments.
Article 3, Section 2, Clause 1: The judicial Power shall extend to all Cases, in Law and Equity, arising under this Constitution, the Laws of the United States, and Treaties made, or which shall be made, under their Authority;--to all Cases affecting Ambassadors, other public Ministers and Consuls;--to all Cases of admiralty and maritime Jurisdiction;--to Controversies to which the United States shall be a Party;--to Controversies between two or more States;--between a State and Citizens of another State; (See Note 10)--between Citizens of different States, --between Citizens of the same State claiming Lands under Grants of different States, and between a State, or the Citizens thereof, and foreign States, Citizens or Subjects.
And the kicker:
Article 6, Clause 2: This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.
___________________________
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
'Laws' being proposed are,
... What's an unauthorized access? Pinging a machine? Reading a webpage meant for internal use but not secured? Attempting to log in as user 'ftp' on a non-public ftp server? Portscanning? What is a portscan? Does telnetting to ports 21, 23, 25, and 80 out of curiousity to see what they're running count as a 'portscan'? D'oh.
People with access to information must make all reasonable effort to provide it to the authorities. Ie, 'We need to see all your server logs because we think the cracker routed through your network' or 'We need your entire anonymous remailer database so we can do traffic analysis to determine which 17 accounts belong to the cracker'; With a warrant... without... ? Will it be a 'crime' to not turn over this information on request? (Well, not for long in the USA but who knows about other countries; the courts will make sure warrants and/or subpoenas are still required to coerce information, but it could take time if the law isn't written that way.)
'Cracker Tools' being outlawed; to draw an analogy, 'lets outlaw drills because they can be used to drill out lock cylinders and gain entry into people's houses!' Uhm. What's a 'computer hacking tool' anyway? Netcat? I'm using it right now to test ftp protocols by hand. nmap? I use it to check that I didn't miss any ports when locking down a box. Nessus? Satan? They'll tell you exactly where a machine is vulnerable. Your machine, somebody else's machine, how are they supposed to know? (Actually, with Nessus you already have to be inside the target to use it, though I'm sure it could be used as a codebase to start a dedicated cracking tool.) My point is, run a security 'auditor' in combination with a 'stealth' portscan and compile a handful of 'demonstration' exploits from securityfocus and you've got yourself a handy-dandy skr1pt k1ddy level cracking-kit built out of security admin tools. Never mind the prior restraint/free speech issues implied since code is text is speech, dammit.
'Illegal to do unauthorized access'
If you ask me, the only 'computer crime' law we need is to make it illegal to destroy or alter information on a computer that you don't have authorized access too, (where 'alter' does not include doing things that generate log entries, etc, etc, long list of exceptions to describe normal behaviour). Yeah, this means if someone cracks your computer without overwriting files or anything nasty like that (like, maybe they sniff your in-the-clear telnet or ftp password transmission...) that you can't do jack about it in court, but so what?
Everyone always wants to draw parallels to the real world: In the real world you don't arrest people for walking into the lobby; you don't arrest people for using the bathroom without buying anything even though it says 'customers only'; you don't arrest people for looking in through the window of a jewelry store or even rattling the cage over the windows. You -do- arrest people for spray painting on the walls of the bathroom or for throwing a brick through the window of the jewelry store and running off with a pocketful of diamonds. Where the access lines between 'use' and 'abuse' are is entirely too vague and if we're not careful the government(s) will write up a set of laws that making any new network protocol illegal - not by intent, but because they're politicians and lawyers, not engineers, and won't know the implications of what they're writing! (Presumably they have enough technical advisors to know the -explicit- meaning of what they're writing, but long term implications are another matter.)
Any-way. The article is very vague; maybe safeguards are being built in to prevent the worries I describe; maybe they aren't; maybe they're penciled in but maybe they'll get erased; keep an eye on it, anyway, because it is -not- 'mostly harmless'.
--Parity
--Parity
'Card carrying' member of the EFF.
The text of the treaty does not use the term "hacking". That occurs twice in the editor's comments, and nowhere else.
The treaty explicitly defines the classes of crimes in question.
There's some bad stuff in there. But it's not QUITE as bad as the article makes it sound.
(One example is the section on seizure, which includes deliberatly denying access to the siezed data.
In the US, seizure as part of a search is supposed to be only to preserve evidence. Denial or disruption of access to the seized material is only authorized when it's an unavoidable consequence of preserving the evidence, and copies of the data siezed must usually be made available to the data's owner at some point in the proceedings.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Reid v. Covert (1957) Supreme Court
- When the United States acts against its citizens abroad, it can do so only in accordance with all the limitations imposed by the Constitution, including Art. III, 2, and the Fifth and Sixth Amendments. Pp. 5-14. [354 U.S. 2]
Commentary on the case here.--