Slashdot Mirror
Law Review Article Says Port Scanning Illegal
Anonymous Coward writes: "The Journal of Technology Law and Policy has a good article on computer security and privacy. If you ignore the more metaphorical crap at the beginning of the article, the author marches through some laws that apply to the Internet and shows how they apply and why his way of deciding what kind of access to a computer breaks the law and what kinds don't is better. (Its based on property and expectations of privacy.) It's interesting to see the computer security from a lawyer's point of view. Especially interesting are his claims that using nmap is illegal, despite the VC3 v. Moulton case. I'm not sure I agree with him, but he definitely makes a pretty sobering case." Actually, I think the metaphors throughout this piece (not just at the beginning) are what make it interesting, and a big component of law is dealing with metaphors. This piece also collects in one place a lot of the cases dealing with computer law.
This is a _good_ article. Law and justice that doesn't have two sides is no law at all... this article goes a long way towards presenting a concept of digital property rights that is _local_.
There is a lot of money and power behind content creators, copyright holders etc. saying "we own this, it is OUR property, therefore we get to scan your computer, send back information to the mothership, and if you are a criminal we get to delete stolen goods off your hard drive, you pirate you! You miscreant!"
The thing is, _law_ sees this and comes back with "If you're saying that is property, wouldn't the person's hard disk be property too? As in 'not yours', as in 'you are a guest but they bought it and own it and live in it'?"
That's the beauty of law and justice- it balances, in time. The inevitable result of pushing for extensive 'property' law regarding copyright etc. is to also cast light on the subject of what kind of property a person's datasphere is.
I even wrote an essay on this in November 1998: it's at http://www.airwindows.com/fiction/essays/Hotel.htm l. When you operate a computer it is like you are moving your stuff around on virtual property: you put something somewhere. Does a company have a right to move it to somewhere else? To pile stuff next to it obscuring it? To paint it a different color, or dust it off? To remove, discard it, set it on fire, impound it as evidence?
The fact that all of this seems totally permissible only shows that law hasn't begun thinking about these issues yet.
You can't have it both ways- if I am forbidden even to portscan a company, then the company is forbidden to go over _my_ computer either. It's analogous. If we're tightening the protections for company-owned 'cyberspace' we're also laying a precedent for tighter protections on privately owned cyberspace.
In the future it may be ILLEGAL for Microsoft to shut off the mp3 encoding in its software and force people to migrate to WMA- or more plausibly, it may be ILLEGAL for them to take a WMA file that was once functional and render it nonfunctional arbitrarily if you don't cough up a license fee. It may also be illegal for them to place restrictions on OEM desktops- on the basis that they make the building materials, the OEM builds the house, the customer buys it and moves in. There is no compelling argument that they must be able to prohibit the OEM from decorating the 'house' as they see fit.
Very interesting stuff in this article, and grounds for hope :)
Guns don't kill people.
It's the damn bullets!
The policy for specifying what is allowed and not allowed is simply closing the damn port in the first place.
Does this mean that Google and company can now be found guilty when searching for open port 80 on networks ?
How about search engines that look for open 21(ftp) port ? , How about gopher ? CIFS (Common Internet filesystem) ? Hmmmm Interesting ..2 C3AF4F2snlbxq'|dc
--
echo '[q]sa[ln0=aln80~Psnlbx]16isb15CB32EF3AF9C0E5D727
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
I don't want a lot, I just want it all!
Flame away, I have a hose!
Only 'flamers' flame!
- 1st paragraph, 2nd sentence:Laws made to protect computer security? How do you protect security? Or does he mean computer security is applied unpredictably? What?
- 2nd para., 2nd sent.Either the word 'in' or the phrase 'partially on' need to be deleted.
- 2nd para, 3rd sent. With property rights, computer owners will not be willing to connect to the Internet if their computers can be abused without legal remedy. So what's his point?
/me gives up in disgust and then notices byline, at the very beginning:
Ethan Preston expects to receive his J.D. from the Georgetown University Law Center in 2001.
Right... and I expect to be made emperor in 2001. I'll never hire a Georgetown alumnus if Ethan makes the grade.
It's kinda like showing a proof of Godel's Incompleteness Theory to someone not versed in math. Each step of the process is simple and straightforward, but as a whole it's tough for an untrained mind to grasp and follow along.
--
--
Mod up a post Rob doesn't like and you'll never mod again
--
--
Mod up a post Rob doesn't like and you'll never mod again
Port scanning IS passive.
...
In the bank analogy, how do you know if they have a door or a window? Photons from the sun bounce off of it and hit your eye in a recognizable pattern.
How would you do this on a cloudy night? A flashlight perhaps?
There's no way (asside from sending out continual broadcast messages from everyone) for a server to broadcast that it is serving something. You simply have to ask. Portscanning is how you do that. You ask if they are serving files. How about web pages? How about
Now, you could make up some convoluted scenario where the bank had photo-cells in the windows to detect if it was night, and your flashlight, unlawfully shined into their windows, blah blah blah...
This would be like if you were scanning for someone sharing files, you check FTP, HTTP, Windows networking, etc... Now maybe someone has a misconfigured program that instead of saying 'No', crashes when asked.
But that's not your fault, you were just asking a question.
If you exploited this, by asking over and over, it'd be akin to harassment. An otherwise legal action would be forbidden by context.
Similarly, portscanning should be legal. It's the way the network works. But malicious use of portscanning, or portscanning connected to a crime, wouldn't be legal.
Port scanning is like looking at a house from across the street. The equivalent of "crawling around someone's house rattling doorknobs, windows, mailboxes, air ducts, rooftop hatches, basement doors, garage doors, electric panel doors, gas valves, water valves, sewer vent lines, outdoor outlets, chimney openings, stove vents" is sending known exploit code to the port in order to see if you can get unauthorized access. It's not even like looking in the windows. A port scan tells you nothing more about a computer than seeing that a window on the second floor has been left open.
The first could be used in the sense of "casing the joint," but it could also be a case of looking at the architecture of the houses on the block without the owners' permission. It may make some people uncomfortable, but it's hardly illegal. A port scan is the closest thing to a look-but-don't -touch on the Net today.
If port scanning is found to be illegal, would a bare ping to see if a site is up and running be made illegal in the future as well? Beware the slippery-slope. We need to make sure that there is a difference in law between commiting a crime and having the potential to commit a crime.
If a script kiddie starts trying known exploits against your box, THAT should be seen as a crime. They are totally trying the vents to see if it's loose so that they can gain access. This is a clear, distinct, and unambiguous step beyond a port scan.
- I don't need to go outside, my CRT tan'll do me just fine.
Verra dangerous, imho, because it's horrdily broad. Building a massive microwave generator and pointing it at your neighbor's house would be legal.
----
----
Am I the only one who thinks Microsoft is a misnomer? Perhaps Macrosoft would be a better fit?
Should you be deprived of the right to examine the quality of a service before buying it, especially when it wouldn't fall under "theft of services"? I think not.
------
How faithful can one be to the private property metaphor without getting into absurd comparisons? If port scanning is illegal, so should looking at someone's house, roof, lawn, doors, windows, etc...
And if law were more like open source, it would be better?! Don't get me wrong... open source is fine for open source but not necessarily for law.
Imagine a system of law in which each person could set up their own government, a system of rules to which nobody else had to conform or comply. Imagine the few most popular standards were only useable by the legislators and legal pundits for twenty or thirty years while the bugs were worked out. The general public wouldn't have the understanding to try any of the several governing distributions by themselves, so they'd have to rely on more experienced people to set up their systems. Over the years, hot contentions would organize blocs of specialists who fought for only one or two standards, even though the underlying system was still supposedly a free-to-be-an-individual system.
Hm, the more I look at it, the US government resembles open source, too.
[
Shouldn't slashdot be making original material? This is copied straight out of kuro5hin. At least put a reference to K5 if you're gonna cutnpaste!
I predict that this could set the record for the highest percentage of replies from people who didn't read the article.
Can someone point out to me where the article claims that nmap, or port scanning, is currently illegal? (Bonus points if you show evidence contrary to the claim. Hint: Moulton did not hold that port scanning was legal; it held that the claimant didn't show damages to the court's satisfaction, and specifically said that Moulton may be subject to criminal prosecution under the Georgia Computer Systems Protection Act.)
After reading through much of the article, I still fail to see how scanning a host's ports is any different from knocking on that host's various doors and windows, seeing if anybody's home, or giving that host's various telephone lines a ring. If you don't want people coming through a doorway, lock the door.
If the right to portscan is overturned, how will a potential customer be able to discover whether or not the owner of a given host has given permission to connect via HTTP, FTP, SMTP, etc.?
Will I retire or break 10K?
2 problems:
(1)Lack of security is an excuse to break in. If someone leaves the root password unset on a machine, or leaves off the security on their web server, the above would say it is legal to access whatever you want on that system - whether it is meant to be private or even if one is explicitly told it is private.
Imagine the prosecutor letting someone who robbed you go free because you "didn't take precautions" (e.g. left personal belongs for a second, etc).
(2) It legitimizes making technical measures have the force of law. If I (as an private citizen) have the technical ability to stop you from entering a public park, should you get arrested for going there anywhere? Heck no. In fact, I wouldn't be allowed to even use technical measures to stop you. That is why the DMCA is so bad. Copyright is limited by fair use - fair use activities are not trespass, they are more like entering a public easement on a property where such is allowed by law. If I as a property owner in the real world block access to an easement (try to build a wall on a road crossing my property), not only do people not get arrested for breaking down/circumventing/destroying the wall, I'll get arrested for building it.
The DMCA turns that common sense notion upside down - the wall builder is ALWAYS right, the others are ALWAYS criminal.
That article seems to feed that thinking.
I am not a lawyer, but I understand common sense - which puts me above most of Congress.
Just because it CAN be done, doesn't mean it should!
Tell me what makes you so afraid
Of all those people you say you hate
Since they're doing it from Korea, China, and Ghana, the fact that it might be illegal here doesn't help your security much.
Or, to put it another way, since you're going to have to secure your systems anyway, why bother trying to make something illegal that actually might have a useful purpose once in a while?
Portscanning should be considered a crime.
...
A long time programming friend of mine mentioned that the most useful courses he took outside of the programming course were a business law course, just to cover the basics of things like this, and a business accounting course, just to get his mind wrapped around modelling what bean counters were doing in the first place.
You would think with all of the legal issues running around, technical types could spend time just to get a toe wet, and get some familiarity with the concepts. It seems very much worth it.
Check out the Vinny the Vampire comic strip
"It is a greater offense to steal men's labor, than their clothes"
I see port scanning as crawling around someone's house rattling doorknobs, windows, mailboxes, air ducts, rooftop hatches, basement doors, garage doors, electric panel doors, gas valves, water valves, sewer vent lines, outdoor outlets, chimney openings, stove vents. Trying all 256 codes on RF X-10 modules, using a frequency counter/scanner to check for and listen in on radio transmissions, ringing phone lines, ringing doorbells, seeing if you can turn on sprinklers/water faucets, etc.
Would you have no problem with someone doing all that? That's a port scan.
"Ringing a doorbell" is a single probe on port 80. "Ring a telephone" is a single probe on port 23. Don't bullshit yourself.
Then you need better glasses.
Your list of metaphorical intrusions and indignities doesn't leave anything to analogize for actual attacks.
You're not going to be able to map the full cycle of casing, analysis, attack, and penetration to the burglary story unless you pace yourself a little.
Remember perspective, it's a wonderful thing.
"Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
It's surely a good news to me. Everyday I got hundreds netbios (137/138/139) port scannings on my Linux server from Windows boxes within the same domain. I always wish somebody would bash them and jail them.
Yes those Windows users might not aware as the netbios port scanning is being done automatically. However, they must take responsible for booting up their netbios port scanning OS which annoy their honest Linux neighbours.
"Say you are a sysadmin. You run a mission-critical webserver. In the status quo, you receive around 40 portscans a minute. Hackers have been successful 3 times on your site. If portscans are outlawed, then the overall security of your site receives additional protection.
Practical benefits like this one should be MUCH more important than simply protecting 'liberty."
Please don't take this as a flame, but this is the same kind of flawed thinking that leads to things like anti-gun laws.
It is an extremely FALSE assumption that merly outlawing portscans will somehow reduce breaking into systems, DOS attacks, etc. Last time I checked, THOSE activities were already illegal.
To have any HOPE of effectiveness, you'd have to outlaw portscanning utilities. And give that law enough teeth to allow the stormtroopers (police) the ability to "find out who has them".
Portscanners have very PRACTICAL and good purposes you know, such as, me, as a sysadmin can use one to make sure the ports I wanted closed ARE closed... To ban portscans and portscanning means more systems will be left open and vulnerable!
Please think about the implications before so quickly giving up a liberty for the (false) promise of government guaranteed safety.
Here is the best quote on this subject:
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.
=== The price of freedom is eternal vigilance
Just wondering, what constitutes port scanning? How many TCP ports need to be probed in how much time to be defined as port scanning? Does a program have to used? If I send 50 http GET requests to a computer within one second, is that port scanning? What about 50 TCP requests to a computer to 50 different ports in one second? I want to know!
D/\ Gooberguy
Karma: Meh (Mostly from meh.)