Hacker Indicted In France For Publishing Exploits

Guillermito writes "Hello. I'm a French scientist living in Boston. I analyse small security softwares under Windows as a hobby, for fun and curiosity. For example, I showed how to easily extract hidden information from a dozen of steganography softwares, often commercial programs claiming a very high security level. I did the same with a french generic anti-virus, showing several security flaws, and that it didn't stop '100% of known and unknown viruses' as claimed. First the company called me a 'terrorist,' than sued me. I've just been indicted last week in Paris. It seems that it's a general trend in France, and maybe in Europe, these days."

Comments

Look on the bright side...

[Anonymous Coward]

Now you get to search for holes in the French jail system. Find a big enough one and you're free!

Re:Look on the bright side...

[Orgazmus]

I think the other inmates might look for holes in him too.

Re:Look on the bright side...

[Anonymous Coward]

It has always been illegal to compromise security in France, whether exposed or not.
Hack a smartcard, descramble pay tv, find a flaw in apache, whatever, u will get busted.
Whether french law allows for it or not, companies and judges will not tolerate it, and bust you ass, and you usually lose out.
They dont care about reason, just dont do that kind of stuff.
Sad but true.

Dinosaurs are dead

[AssProphet]

What does stenography have to do with software? Didn't they become extinct millions of years ago?

Re:Dinosaurs are dead

[Strog]

The author was probably thinking of

Stegosaurus:(from Gr. o-mvhc, close, narrow, and yp~eu, to write), the system or art of writing by signs representing single sounds or groups of sounds, single words or groups of words, sometimes also styled brachygraphy (Gr. ~poxi5r, short); it is a general term including all the various systems of shorthand writing (see SHORTHAND).

Give him a break, he's getting taken to court over this. Good spot though. ;-)

Good luck!

[Anonymous Coward]

I wish you the best. You should be given job offers, contracts, and cash for what do you, not put on a cross to die! It's a shame, really. Hopefully your case goes public and some good lawyers will help you for cheap if they think the press for themselves is worthwhile. Good luck!

Re:Good luck!

[Timothy Brownawell]

He should have simply posted that these packages could be exploited and not posted the actual exploit.

But would anyone have believed him?

Tim

Re:Good luck!

[tomhudson]

If you read the article, he was charged with "counterfeiting and concealing counterfeiting". I guess that's because there's a way to twist the law in some prosecutor's mind so that the charge seems to apply.

Sort of like calling spitting on the sidewalk a "terrorist act" because it could be labeled a "biohazard" if you really stretched it.

I echo the parent posters' sentiment: bon chance!

Re:Good luck!

[gilesjuk]

The problem is such exploits are published and not referred to the companies in question for them to fix these faults.

By publishing exploits you are on one hand helping consumers choose their security software wisely, but on the other hand you are providing hackers will methods to penetrate systems.

Re:Good luck!

[Buran]

On the third hand (this guy must be a mutant! ;)) a lot of companies won't bother to fix flaws if they aren't publicly and obviously posted, so crackers might find the flaws and use them for exploits, while the company that makes the software gleefully ignores the problem and gets to avoid responsibility and liability. That's definitely not good. I don't know (it's not clear from the English writeup) whether any attempt was made to notify, but many people who release exploit data do so only as a last resort.

Re:Good luck!

[maxpublic]

The problem is such exploits are published and not referred to the companies in question for them to fix these faults.

And there's absolutely no ethical obligation on the part of the person who finds the flaw to inform the company before informing the public. It's up to the company to prevent the sudden appearance of egg all over their faces, not folks who aren't their employees and aren't getting paid by said company to find such faults in the first place.

Funny how well corporations have managed to brainwash some people into thinking otherwise...as if in the end we're all their employees and 'owe' them something beyond the price we pay for their (buggy and insecure) software. I wonder when this little tidbit was included in the definition of 'capitalism'?

Max

There is no faster way

[ThisIsFred]

There is no faster way to make enemies than to point out someone's stupidity, and then prove it publicly. But I am on your side. Companies that market security products that aren't are committing fraud, IMO. And I'd rather have you publish the vulnerability than someone else publish the automated exploit.

Re:There is no faster way

[LionMage]

There is no faster way to make enemies than to point out someone's stupidity, and then prove it publicly.

Never have truer words been spoken on Slashdot. (Well, OK, that's probably not true, but this is an idiomatic expression in English...)

After publicly commenting in my weblog that I found a WiFi access point in my office building being run wide-open, with no security (not even a password), and noting that this access point belonged to someone in the Honeywell office just down the hall, I ran into an interesting situation several months later...

It seems that one of Honeywell's lawyers noticed this blog entry and found out that I was employed by a consulting firm that had Honeywell as one of its biggest customers. So Honeywell's solution to the embarrassment of having a gaping security hole pointed out publicly was to pressure my employer into firing me. Luckily, cooler heads prevailed, and I let Honeywell image the hard drive on my laptop; the Honeywell employee who set up the rogue access point wasn't so lucky.

The moral of the story is, large companies are humorless, and the bigger the company, the more draconian the steps they'll take to protect themselves and their corporate image. That doesn't mean you should cower in fear whenever these companies flex their muscles.

Glad to see...

[BJZQ8]

I'm glad to see that the EU has broken the U.S. monopoly on wacky, mindless computer lawsuits!

Re:Glad to see...

[Dr.Dubious DDQ]

I realized France had joined the 'stupid lawsuit that wins anyway' club with the whole Mobilix/Obelix thing...

Re:Glad to see...

[Anonymous Coward]

I'm hoping your horizons will one day expand to the point that you realize the US has *never* had a monopoly on stupidity of any sort.

Enshrined protection of whatever

[The I Shing]

I sure am glad I live here in the USA where my right to expose the weaknesses of corporate products is enshrined in our beloved Constitut...

Hold on, there's a SWAT team banging on my door.

I'd better go let them know that they must have the wrong house.

Re:Enshrined protection of whatever

[ThisIsFred]

Hold on, there's a SWAT team banging on my door.

Excellent! Would it be too much trouble for you to go outside and ask the SWAT dev team why the default is to look for smb.conf inside /usr/lib instead of /etc/samba? I mean, who puts configuration files in with userland libraries?

Re:Enshrined protection of whatever

[paranode]

You joke as if people here do not have that right, but it has already been shown that such free speech is protected here. Not only that, but you can even distribute source code to exploit it.

Re:Enshrined protection of whatever

[The I Shing]

You joke as if people here do not have that right, but it has already been shown that such free speech is protected here. Not only that, but you can even distribute source code to exploit it.

And, by God, let's pray that it stays that way, brother.

Re:Enshrined protection of whatever

[bugnuts]

Free speech on security vulnerabilities is protected, you just can't be distributing code to bypass copy protection.

It's not just copy protection, but encryption schemes, which you can easily claim steganography is, since it shares many qualities. Remember that Adobe used the DMCA to prosecute someone for "breaking" their ROT13 encryption. And IIRC, 2600 lost their appeal for publishing links.

This law is being cited to enable all sorts of abuses by corporations that have roomfuls of attorneys, and has been used to leverage threats to a researcher from disclosing weaknesses at a convention. It was initially cited to threaten the guy that disclosed the "shift-key" exploit on CD protection. No sane researcher would rule it out in the USA -- you still would have to answer to it being abused.

Re:Enshrined protection of whatever

[Maestro4k]

• You joke as if people here do not have that right, but it has already been shown that such free speech is protected here. Not only that, but you can even distribute source code to exploit it.

At one time I would have agreed with you. Having had an encounter with the government over false accusations made against me (not even computer-related), and having seen the results, I have to say that in theory we have freedom of speech, in PRACTICE, the government can quite easily ruin your life over something you say, even if they can't even charge you with anything.

Remember, publicity about something you're accused of is all the court of public opinion needs to convict you. Winning at trial (if you're charged) or having things dropped later on aren't enough to undo that. To use what's probably a bad example, remember the OJ trial? He was found not guilty of murder, but exactly how many people do you know who believe that to be the truth? And how many do you know who'd hire him to work for them, even if it was digging ditches?

Finally don't forget that fighting charges against you can bankrupt you. Even if you end up innocent, you may find your life utterly and totally destroyed thanks to this. Frankly our "justice" system has lost all its justice, and innocent into proven guilty has gotten forgotten somewhere along the way.

Re:Enshrined protection of whatever

[Henk Poley]

"SWAT" stands for "Skilled Workers With Advanced Tools." in the Rapid Application Development (RAD) context.

Re:Enshrined protection of whatever

[computational super]

Unless you're accused of "Terrorism" (as the poster was). That's the tricky point - even here in the U.S., if they use the "magic word", the Patriot Act trumps the constitution. I'm not being facetious - that was the whole (only) point of the Patriot Act. "The bill of rights makes it hard to fight terrorism, so repeal it for people we say are terrorists. We promise we won't abuse it."

Re:Enshrined protection of whatever

[Short Circuit]

I guess the results are on a case-by-case basis. When my mother (who had/has custudy...we're all grown now.) took me and my brother on a vacation to Florida, my biological father called the FBI telling them she had kidnapped us.

The FBI got really pissed at him when she provided the court documents proving she had custody.

The moral of the story is to document everything that can serve as evidence on your defence.

I may wear a tin foil hat, but I wear it with pride.

Re:Enshrined protection of whatever

[Openstandards.net]

That's extremely true, and I wish more people were aware of it. This actually started in the 80s when we created the Foreign Intelligence Surveillance Court (FISA) court to gather evidence on alleged spies without public accountability and sealing of the evidence so the defendent can never see it even when it is the primary evidence used to prosecute.

This became a rubber stamp court, with only one request out of over 7,500 since its inception being rejected by the judges. Of course, the people are unaware of it because the proceedings of the court are secret, and the defendents are usually unaware of the evidence being used against them.

The existence of the court is not secret though, as it was created by a law passed in the 80s, and the quantity of searches granted by the court is public. Indeed, the US government was accused of abusing this court recently to broaden its purpose, before the Patriot Act was "clarified" to permit such abuse by the US prosecutors, FBI and intelligence agencies. One of the judges on the panel scolded the US government for being deceptive in the types of cases it was bringing, indicating that the US government does try to bring people before FISA that are not spies, but instead ordinary criminals. The US appealed a decision to legally obtain a broading of the courts purpose, originally without legislation.

If I remember correctly, congress passed a law to "clarify" that the Patriot Act extended this to cover those suspects of "terrorism". Hasn't it occurred to anyone that none of the trials of suspected terrorists are public?

This is such a sad demise of the US Constitution and American liberty. To me, I'd be willing to die like our forefathers did to preserve American freedom and create the Bill of Rights. I just wish we weren't so willing to discard it today under the illusion that our life-spans will be longer. When I was a child, being willing to die to perserve American freedom was a common notion. Now, being willing to give up freedom to avoid the remotest chance of dying, no matter how statistically improbable, has become a de facto notion. To suggest otherwise, well, that would be unpatriotic! Or would it be terrorist?

Unfortunately, without the ability for the press or the people to attend trials of suspected terrorists, it's unlikely that this will ever be overturned. We'd have to prove that the system as used unjustly, but the Patriot Act has removed all accountability, so that it is nearly impossible to prove the injustice.

The question is, if it was "spies" yesterday, and now includes those labeled as "terrorist" or "threats to national security" by the investigators and prosecutors today, then what label is next? Or, are the current labels broad enough to permit US prosecutors to throw anyone in prison for life that they see fit? It's hard to discern when our government is no longer accountable to the people it's supposed to represent.

Is there anyway to determine what cases the government has filed to prevent public accountability under the Patriot Act? I'd like to follow up on this to at least try to estimate how many cases there are today. If at all possible, I'd like to know if it even remotely possible to discover any injustices occurring. Justice is, after all, the purpose of all this. Right?

Links:

THE SECRET FISA COURT: RUBBER STAMPING ON RIGHTS
Secret court meets to consider Justice Department appeal
Secret court gives U.S. gov't wiretap powers
Secret Court Rebuffs Ashcroft
Secret court may limit government power to spy on domestic terror

These links aren't in chronological order, and I obtained them using a simple

'Bout Time

[LooseChanj]

To move to a sane country. There any left?

Re:'Bout Time

[Orgazmus]

Could try Norway?
DVD-Jon got off the hook over here, why should'nt it work this time? ;)

Re:'Bout Time

[lambent]

DVD-Jon also got tried twice for the same crime. I'll stick in the US where double-jeopardy (and a very large back yard to hide in) affrods some sort of protection from that sort of thing.

Re:'Bout Time

[kajoob]

Instead of packing up and running every time something happens that you don't like, why not stick around here and fight for what you believe in? You can start by sending a few bucks to the EFF.

Re:'Bout Time

[Monkelectric]

Probably not, but I hear the girls there give great head.

Re:'Bout Time

[General Fault]

Maybe if all of us techies leave and invade some other country, kicking all of the non-techies out... we could rule the world! Talk about nerd nation. We could let the rest of the world fall into the dark ages, then take over.

So, now all we have to do is decide which country... How about the moon?

Re:'Bout Time

[uwquazi]

One small problem with this: The nerd-nation won't last past a generation. You need TWO sexes for that.

Re:'Bout Time

[Patrik_AKA_RedX]

We could let the rest of the world fall into the dark ages, then take over.

After the techies left, the signs of decay appeared everywhere throughout the world. Every clock displayed the blinking 12:00 of doom. Frighted people went looting when their desperate search for the outlook-icon showed fruitless. Millions of messages never reached their destination as countless people failed to access their voicemail. Finaly famine striked the dark cities after so many were unable to plug their microwaves in. Chaos, darkness and fear were everywhere and soon Man was only but a vanishing memory in minds of the few surviving animals.

But after the dust had settled, the techies of the world resurfaced and a new nation was born. A nation without the fear of crashs, without spam or wild procecutions. Even the evil RIAA which terrorised the lands was no longer to be feared. And from that day on not a single clock had ever been stuck on blinking 12:00 again.

Re:'Bout Time

[bckrispi]

Tell that to all of the people who get off on state charges only to find themselves facing Federal charges....

Jeez, anyone who's taken Criminal Justice 101 knows that this is not double jeopardy!! If you steal a credit card number and make purchases on it, chances are, your state has a law against this kind of fraud, so you've committed a crime against the state. Theft of a credit card is also a Federal Offense. And you've probabally also violated a Civil law that will open you up to a lawsuit from the theft victim for his "pain and suffering". Yes, you've committed "one" act, but that act is a crime in three separate jurisdictions - ergo three separate crimes, which means each jurisdiction will have an opportunity to get a piece of you. Double Jeopardy would be if you had been aquitted of the State charges, and afterwords the State charged you again for the same crime.

Proposterous!

[Doesn't_Comment_Code]

I'll admit right away that I'm not familiar with France's free speech laws.

But from a common sense point of view, I really don't see how telling the truth about weak software can be illegal. It may lead to damage to a company, but that damage was caused by the security holes, not someone exposing them (hidden defects are a ticking timebomb anyway.)

From the common sense view point, it also seems right to inform the company first, before telling everybody. But telling the truth should not be illegal.

Re:Proposterous!

[General Wesc]

It's illegal to insult people. But so long as he didn't release the vulnerabilities saying 'this moronic company. . .' :-)

(Are companies 'people' in France?)

Re:Proposterous!

[gl4ss]

well most likely they made up most of their claims(of what the poster had done) and just want to set an example or something insane like that.

just like there's jerks in usa there's jerks in europe as well.. and probably in middle-east and far -east as well. there's quite a few of totally broken 'security' products that are not even meant to work more than just give false assurance to their users, they're people selling snake oil and as far as their products go their just as good as some "miracle magnets" for fuel-lines & etc. there's no point in informing the company in such case since the fuckin company is just basically fraudsters in the first place.

Re:Proposterous!

[Particle010]

I think you're missing the point here. Freedom in genral does have one very important price, and that's responsibility. Sure you could point out those aspects of the software to the general public, but you have to ask yourself one question: with regards to the fact that leaking this information publicly could and most likely will lead to the compromise of systems using said software, is it the responsible thing to do? The common sense answer is NO. The responsible thing to do would be to privately alert the company of the security problem and perhaps documenting such to prove you warned them in case of inaction.

Re:Proposterous!

[Monkelectric]

Freedom in genral does have one very important price, and that's responsibility.

No jackass, you're wrong, and you're thinking like one of "them". The "responsibility" lies with the comapnies making *FRADULENT* claims.

You're saying this fellow should politely inform these companies that they are lying? I think they know already.

Re:Proposterous!

[silas_moeckel]

Yay one more for security through obsurity. Lets try this on something tangable if there was one spot on a certine car that if you did somehting the cars doors would open and the engine would start up lets say hit it with a 5lb hammer. Should you be arested for not telling toyota first and waiting for them to fix it? Should 5lb hammers start to be concirered car theft tools?

People need to be made aware of the vulerabilities of anything ASAP. The person that makes it public may not be the first person to find the issue. Network elements can be made to stop the exploits or reduce there impact. It's not fair to say well most people dont care about there systems so we will protect the lazy at the expence of the vigalent. Allways remember patching is not the only solution to an issue it's generaly the best in the long term but you can have a lot of other methods at your disposal as well in the short term.

Terrorist??? Sounds like libel to me.

[JDRipper]

If they publicly called you a terroist in writing without sufficient evidence, can't you sue their berets off for libel?

In America it's totally different

[Anonymous Coward]

We sue first, and then we call you a terrorist.

I'll burn in hell for this ...

[crimethinker]

Well, since you are French, there is only one thing you can do:

SURRENDER to the authorities.

Seriously, though, this sucks ass.

However, I'm quite sure that you're a terrorist, because we all know that terrorists publish the exploits they find. Why, back in June of 2001, I saw an article about how to smuggle knives onto airplanes. I also remember seeing an article shortly after that about putting plastic explosive in your shoes (i.e. Richard Reid). Come on, folks, people who find and PUBLISH weaknesses in software are not the problem.

-paul

Who was it that said...

[Le Marteau]

"It's dangerous to be right when the government is wrong".

This is a case in point. The author may be in the right, but we are living in hysterical times, and woe unto the man who walks in front of the governmental steam roller with a team of jackasses and corrupt, ignorant polititians at the wheel.

Re:Who was it that said...

[MarkusH]

That would be Voltaire.

Another good quote: "There are some acts of justice which corrupt those who perform them." - Joubert

Re:Who was it that said...

[WormholeFiend]

ohh ohhh a quotation contest!

"Where is the justice of political power if it executes the murderer and jails the plunderer, and then itself marches upon neighboring lands, killing thousands and pillaging the very hills?"
Kahlil Gibran

"The very first law in advertising is to avoid the concrete promise and cultivate the delightfully vague."
Bill Cosby

"It is from numberless diverse acts of courage and belief that human history is shaped. Each time a man stands up for an ideal, or acts to improve the lot of others, or strikes out against injustice, he sends forth a tiny ripple of hope, and crossing each other from a million different centers of energy and daring, those ripples build a current that can sweep down the mightiest walls of oppression and resistance."
Robert Francis Kenedy
- /got nuthin
-

Re:Who was it that said...

[Le Marteau]

ohh ohhh a quotation contest!

"Did you really think that we want those laws to be observed? We want them broken.
You'd better get it straight that it's not a bunch of boy scouts you're up against . . .
We're after power and we mean it. You fellows were pikers, but we know the real trick,
and you'd better get wise to it. There's no way to rule innocent men. The only power
any government has is the power to crack down on criminals. Well, when there aren't
enough criminals, one makes them. One declares so many things to be a crime that it
becomes impossible for men to live without breaking laws. Who wants a nation of law-abiding
citizens? What's there in that for anyone? But just pass the kind of laws that can
neither be observed nor enforced nor objectively interpreted - and you
create a nation of law-breakers - and then you cash in on guilt. Now that's the system,
Mr. Rearden, and once you understand it, you'll be much easier to deal with."

From "Atlas Shrugged" by Ayn Rand

Signs of the future?

[Anonymous Coward]

Now, if Microsoft is forced to release the windows source because of the EU, does this mean anyone who points out vulnerabilities will get sued too?

Seems like a strange way to thank someone for helping them. It's like beating someone to death with a tire-iron because they told you your tire is flat.

Stops 100% of unknown viruses?

[RubiCon]

Umm, you can't do that - I think I first saw the relevant paradox in Ralf Burger's book on viruses and it goes something like this: Say you've got some blackbox routine called is_a_virus() that does just what these guys claim; all you do is build it into a virus like so:

if ( is_a_virus(me) ) { do_nothing() } else { replicate() }

So, if you're a virus, you're not a virus - but if you're not, you are. Reductio ad absurdum, anyone?

Re:Stops 100% of unknown viruses?

[HeghmoH]

This is nicely covered by Rice's Theorem. In short, Rice's Theorem says that it's impossible to write a program to determine with 100% accuracy any property of another program's behavior or output.

Rice's Theorem is basically a generalized version of Turing's proof that the halting problem can't be solved, and it uses exactly the argument you outline.

Re:Stops 100% of unknown viruses?

[lavalyn]

Catching all viruses is easy. Label all files viruses. Isn't all that helpful but absolutely "true."

Just like flagging all spam is easy, or flagging all important email important is easy.

(For those in statistics, Type I and Type II error.)

Re:Stops 100% of unknown viruses?

[musikit]

maybe they fulfill their claim by executing the following commands

deltree C:\Program Files\Outlook Express
deltree C:\Program Files\Internet Explorer
deltree C:\Program Files\Microsoft Office

Re:Stops 100% of unknown viruses?

[bugnuts]

This is exactly how Kirk and Spock killed all those evil computers like Nomad and Landrew.

did they redefine extorion and not tell me...?

[spacepimp]

they sued you for experimenting and testing their claims? ie the virii statement. i cant imagine how this is any different than test environments in larg ecorporations before a deployment or rollout.. did you perhaps send them bill, demanding it be paid or you will reveal their mis statment of facts or perhaps, say you found a way around their security pay you to keep silent or ruin toir prifit model like what happened with google perhaps.. im curious to hear more about how this was taken as extortion it doesnt seem to fit with the words definition.

contact the eff

[gmr2048]

dunno if they can help with french courts, but it's prolly worth it to at least bring it to thier attention:

www.eff.org

-gary

hmmm

[frode]

The French courts would probably back down if you threaten to invade.

Heck I'll help. I could use a spare country.

Re:hmmm

[Rick.C]

I could use a spare country.

Maybe, but why would you want France???

The morale of the story is..

[Murf_E]

don't go tell the company that their product is flawed but rather use your discovery to exploit people who use their product. Either way you will be sued but at least this way they have to find you

How can *this* be illegal ?

[lazy_arabica]

Is looks like looking for security flaws is increasingly seen as an illegal action by both companies and governments.

Would I be sued if I told a company manufacturing bicycles that their products are not solid enough, and then can be dangerous ? Probably not.

It will soon be forbidden to even talk about flaws. As a french citizen I feel very sad about it...

Re:How can *this* be illegal ?

[DirkDaring]

"Would I be sued if I told a company manufacturing bicycles that their products are not solid enough, and then can be dangerous ? Probably not."

Probably not, no. But you could easily get a lawyer to get someone to fake an accident and sue the bicycle manufacturer for damages.

Re:How can *this* be illegal ?

[Anonymous Coward]

Yes (at least if you publish the info). Consumer Reports has been sued for demonstrating flaws in products .

Good or Not?

[Prince Vegeta SSJ4]

I haven't brushed up on the law concerning publishing exploits in either France or the US, but it seems a little ridiculous to indict someone for pointing out a security hole.

Sure it can be said that publishing an exploit will encourage a hacker to take advantage of said exploit, but by not publishing & letting it remain a secret is no guarantee that someone is not exploiting that same exploit. In fact, I'm willing to bet that some 3v1| H4x0r would eventually find it anyway. But I would rather know that it exists so that I may act, since, in my experience software companies are slow to react and try to hide or downplay flaws.

Security solely by obscurity doesn't work.

On the flip side, if the door to my house was wide open, I wouldn't want anybody yelling hey your door is wide open (to the world) without allowing me to fix it.

IMO it boils down to common sense, and in this case I think that it is a beneficial thing to publish that sort of information. An even better route would be to alert the software makers first, and give them a 'short' time to release a patch. But only a very short time.

Re:Good or Not?

[earthforce_1]

If you discovered a critical safety flaw in a particular model of automobile, do you:

i) Let everybody know, so those who drive that particular model can get it fixed, or

ii) Let only the manufacturer know, so they can fix it in next years model first.

What about the poor souls who are relying on the software for the security of their business? With your door analogy, it is equivalent to letting the lock manufacturer know that their locks are defective, without notifying the homeowner. (End user) It is their doors that are vulnerable. Of course by broadcasting this to the world, you let the bad guys know at the same time, but IMHO it is better than saying nothing.

Re:Good or Not?

[carn1fex]

but it seems a little ridiculous to indict someone for pointing out a security hole. Exactly. What if the magazine Consumer Reports was reviewing their product and found this defect? Could the magazine then be indicted? How does this bode for private entities doing public reviews of a product?

Re:Hax0r teh planet!

[strictnein]

Alternatively, mail a picture of a rifle to the French government. that will make them back down.

Nah... they'll just draw a line on the ground and politely ask you not to cross it, or go around it.

Note to Europeans

[strictnein]

Note to Europeans: while it is fun to point and laugh at us "stupid" Americans and our silly laws and lawsuits, you might want to take note that the same things are going on in your countries too, and will continue to get even worse.

This sucks

[Nevo]

Unfortunately, it appears that expertise in French law is lacking here at slashdot.

I second the suggestion above: contact eff. Now. If they can't help they probably can point you to organizations that can.

Well.... Let's be honest here...

[Shirov]

If you were simply using the software and found exploits through the interface, then I totally agree, this is bullshit...

HOWEVER, if you were digging through reverse engineered proprietary code, and publishing exploits at the code level... well, that is infact illegal...

Good luck either way though...

"I used to have a sig, but a cheese eating surrender monkey ate it..."

--Ryan

France is Stupid

[Omega037]

I know a guy who for his senior thesis worked with a group of people and hacked a company's network. At the end of the semester, they gave the company a 42 page document stating all the problems and exploits the company had.
He got an A for the class and a job offer from the company. Granted, he already had better offers, but it is a good example of how it should be.

Re:Just a thought...

[happyfrogcow]

safer, but should be completely unnecesary.

Please Publish Address of Officials here

[randall_burns]

I would like to write a letter in support of you. The people that should be legally hassled here is the software vendor whose fraud you exposed-not
you.

IMHO a pile of letters coming from all parts of the world in your support might send a signal. I also think that Amnesty International should be contacted here. This is even more sleezy than most of the stuff they take on--in this case you appear to be hassled not because of your political opinions, but because French officials are using their offices on the behest of corrupt corporate interests.

Been done in other respects

[Stevyn]

This is like a mechanical engineer publishing tips and tricks on how to break open safes that claim to be "burgler proof." Or Diebold suing someone who figured out how to rig elections. This is like the "wag the dog" scenario where you start a fight with someone to move attention to them and away from your shortcomming.

Re:And I thought the DMCA was bad ...

[Peden]

Whats up with this France bashing? Seriously, is this all because France and Germany (unlike Denmark, where I am from) wouldn't fall for baby-boy Bush's nagging and crying? I did not really get the whole "french toast" and "freedom toast" stuff, whats your (and here I mean Americans) problem with the French?

Donations!!

[3terrabyte]

If anyone knows of a way to donate to this guy to pay for his legal bills, and (hopefully not) fines, please post a link.

Re:Donations!!

[DeionXxX]

I wonder if he ends up being convicted if we can be accused of aiding a terrorist...

-- D3X

Copyright infrigement

[aepervius]

Plese note that he has been accused of copyright infrigement. He seems to have reverse engineered and copied/used part of the intern code of the programs. Whether we like it or not DMCA like law forbid it except in a few case (interroperability and maybe for academia). Since he did not publish it for academia, and he did not contact first the company, they can fall on him and he has big probability of being judged guilty.

The law might be broken in that case (as we all know for DMCA like laws) but nonetheless the company has a case...

Re:Copyright infrigement

[DR SoB]

Sweet:

1. Create really shitty code.

2. Claim code is UNHACKABLE and will detect ANY unknown virus

3. Wait to get hacked (should take about 2 minutes)

4. Sue hacker(s).

5. Profit!

6. Sell your crappy code to microsoft

7. More profit!!

(Does this mean we could make a class action suit against SecurityFocus?)

Be sure to tune in next week...

[Liselle]

... when the intrepid crime-fighters in the US DOJ sue the EU for patent infringement to proect their monopoly.

Re:French First Ammendment?

[aat]

Here is the English translation of the constitution of Fifth Republic, France's current constitution, written in 1958. Last time I looked at it, I couldn't find any free speech clause. (Some of France's earlier constitutions had such clauses though).

French constitution

Or maybe the Declaration of the Rights of Man, which does have a free speech clause, and is a principle as mentioned in the Preamble to the French Constitution, has legal binding. I don't know.

You should also note that France heavily restricted the use (not just the export) of crypto for a long time, (except possibly if you deposited your keys with the government), so I really doubt their commitment to computer freedom per se.

This is sad...

[Anonymous Coward]

you don't have to be good anymore. You don't even have to look good anymore. All you have to do is sue the pants off of anyone who proves you are not good!

Anyone who buys this company's products needs their fucking heads examined!

In the interest of fairness

[Progman3K]

It should also be a punishable offense for a software maker to NOT close exploit holes in a timely manner.

I can see the case being made that leaving exploits open is essentially supporting terrorism, or depraved indifference at least.

Fighting back

[Animats]

It's going to cost him, but this guy needs to file false-advertising and libel claims in France. France has stricter laws against both than the US does. Then he needs to get a few good articles published in some French papers. Libe, for starters.

He may be in Le Figaro today. Look for "Quand les createurs de virus se font la guerre" in Le Figaro's archive. You have to pay to read the article, though.

Even though I am not a lawyer,

[Morologous]

I would strenuously advise you *NOT* to discuss your legal situation or case with anyone but your lawyer.

I'm aware you're French, and likely will be prosecuted in France, however, it's generally the case that any public statements you make can and will be used against you in court, thus, I would advise that you seek professional legal counsel and stop publicly discussing your upcoming case. It can (and usually does) limit the variety of strategies that your lawyer can use to defend you.

Re:Even though I am not a lawyer,

[happyfrogcow]

Sure, but with the laws they've been comming up with lately, once he's arrested he might not be heard from again. I think it was a necessary move to make the situation publically known. Otherwise, all you see is a blurb on page 12 of the newspaper saying "French Hacker Arrested" and no one thinks anything about it.

Though, do seek professional counsel.

Questions...

[cindy]

I'm sure I'll get burned at the stake for this, but what the heck...

How many sides of this story do we have? Hmm, just this guy's side. Interesting.

Did he make any effort to alert the creators of the software before he published the info? Not that I could tell from the linked info. It sounds like he just posted it on his web page and published it in a crackers magazine and let the chips fall where they may. Not exactly responsible activism.

What exactly *is* the law regarding this in France? Here in the States we have the DMCA. It's a terrible law, but we all know what we're getting into if we break it. That's what civil disobedience is all about, isn't it? I seem to recall that Europe has similar laws on the books.

I'm sorry, but with the info we've been given this sounds a little like "I did something naughty and I got caught and now I might get PUNISHED! Oh poor me!"

All kneejerk reactions aside, maybe there's more to this situation than we've been given.

Re:Questions...

[lone_marauder]

Did he make any effort to alert the creators of the software before he published the info? Not that I could tell from the linked info.

That raises an interesting question about responsible/ethical/legal vulnerability reporting practices. Could you imagine how absurd it would be to require similar restrictions upon political speech? :

• If you find a vulnerability in a candidate, you must privately contact the candidate to discuss remediation terms
• Only after a remediation period determined by said candidate can you discuss the flaw publicly.

Even in civil law relating to libel and slander, your only problem is usually whether or not the information is true.

Re:Questions...

[greppling]

Did he make any effort to alert the creators of the software before he published the info? Not that I could tell from the linked info.

Well. The "exploits" he published are so trivial that the company certainly knew about them being possible (see my other post here). Any hacker caring about this product would be able to find them. In such a case, I agree that the responsible is to educate the public about the flaws.

lots of unanswered questions here

[tuxette]

The question: is it possible in France today to publish software flaws, and the practical demonstration of these flaws? I am not yet judged, but I am pessimist about it, and it seems that we are heading towards a negative response. If I am declared guilty, full disclosure is going to be de facto forbidden in my country.

I'd be surprised if he were not acquitted, but you never know these days. It's very easy to pay off a judge. Anyways, one thing I would like to know is how publishing code in order to expose security flaws, and where the author(s)/owners of the code are referred to, is any different than publishing excerpts from a book in order to expose, say racist sentiment.

Other side?

[BillFarber]

The court of Slashdot seems to be siding against the French judicial system, but shouldn't we hear their side of the story first? I'm not saying this guy is lying - just that there are two sides to every story.

Re:And I thought the DMCA was bad ...

[Darby]

A lot of the recent France bashing is due to this, but that is hardly the only reason.

I personally do not like the French in general because both my father and step-father were in the Air Force in Vietnam.

That should be enough info for some of you out there, but for those who don't know:

Some Air Force personnel were shot down over North Vietnam and managed to get themselves safely to the French embassy thinking that since we were allies and we were fighting a war they had started in the first place that they would be smuggled back to their unit.

Instead the French, hoping to get in good for the after war profiteering, turned them over to the North Vietnamese who proceeded to torture and murder them.

That is one reason people (in general, not just Americans) hate the French.

Re:And I thought the DMCA was bad ...

[Deflagro]

Propaganda, that's the real enemy. Here in the US, Europe is seen as ignorant loaners who don't want to help anyone take over the world. I'm not a big fan of the french attitude, and I am french (Canadian). I just hate to see people blindly spout vulgarities when most of them probably have never met a real frenchman. In my experience, they're annoying but fun at parties.

Haven't he learned his lesson?

[WildBeast]

I remember some articles on Slashdot about something like this happening to hackers like that. Obviously this hacker missed those articles. And now with all the terrorist crap and new laws, it's very easy to put people in prison for anything.

Look on the bright side...from another french...

[da5idnetlimit.com]

1/ Call France 3, TF1 if you can.
TF1 certainly won't give a damn, but France 3 has a local news agency that is capable of nicely covering your story.

2/ Attack the company for "Publicite mensongere" (you Grammar Nazis translate for yourselfs, the guy is french...), bringing with you the proofs you digged out.

2bis/ Attack them for "tentative d'intimidation", and another one with Libel (atteinte a l'honneur)
The Libel one will only bring you 1Eu (the official price for honor)

3/ Include the Paris Chamber of Commerce, 60 millions de Consommateurs, and probably one or two IT Newspapers (01 Informatique, Le Monde Informatique), write to the Minister of Justice (Sarkozi is out of Interior, and he won't care anyhow)

60 Millions de Consommateur is very possibly the best first to call, as they are very touchy on such issues, and help people defend their case.

Just doing the counter attack on "Publicite mensongere" to the responsible organisation will be a frightening step for Tengram...

Also, publishing your discoveries on CERN and all others security sites (french and internationals) will be a de-facto victory.

Also, have the court ask for an independent expert to verify your findings... In France, there is a law against punishing people that just said the truth...

If you really want to be vicious, take a look on their webpage, check all their "reference customers" and have them see your papers and security holes...If one of their customers is a French Governemental Agency, they can be in for a very hard time... Lying to the French Administration, and putting their security under threat for innefiency can bring them under a lot more problems than you can think.
So, this is just the top of my head ideas, but I hope it will help you...

In such cases, the better defense is offense...

Bonne Chance, Courage, et ne te laisses pas faire !!!!

don't be silly

[mblase]

Unfortunately, it appears that expertise in French law is lacking here at slashdot.

You must be new here. On Slashdot, everyone is a legal expert in everything.

publishing vulnerabilities paper

[weld]

At a recent Yale conference, Digital Cops in a Virtual Environment, Jennifer Granick presented a paper, Computer Crimes and Intermediary Liability: The Case for Protecting Vulnerability Publications on the legality of publishing vulnerability information.

Vulnerabilities in security products, especially those making outrageous claims, need to be exposed.

excerpt from NAI ePolicy Orchestrator Format String Vulnerability

"When deploying new security products within the enterprise, organizations should understand the risks that new security solutions may introduce."

-weld

Increasing security

[rfrenzob]

Computer security can be increased by the following methods:

1) Deny the flaw exists
2) Sue the person who discovered the flaw under the DMCA or something similar in your locale
3) Blame "hax0rs" who write tools like diff
4) "Donate" to campagin funds of elected officals who pass laws that make security research a federal crime

Not an all inclusive list, but it should be a good start for your security minded company or .com

My only question...

[orty78]

My only question is, aside from application of the DMCA in the U.S., how is this kind of information any different from say, Consumer Reports? Those guys go out of their way to break cars, appliances, and other consumer products.

Re:My only question...

[SillyNickName4me]

Yeah, and surprise surprise, companies try to sue the publishers of such reports as well.. not that they win often but you can always try.

Re:French First Ammendment?

[lxdbxr]

Article 10 of the European Convention of Human Rights might apply, though (IANAL) I believe the wording is rather weaker than the US version (with my emphasis):

1. Everyone has the right to freedom of expression. this right shall include freedom to hold opinions and to receive and impart information an ideas without interference by public authority and regardless of frontiers. This article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.

2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or the rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.

France is a signatory to the Convention though I have no idea how (or indeed if) it is implemented in French law directly.

Re:Look on the bright side...from another french..

[Anonymous Coward]

1/ Call France 3, TF1 if you can.

2/ Attack the company for "Publicite mensongere" (you Grammar Nazis translate for yourselfs, the guy is french...), bringing with you the proofs you digged out.

2bis/ Attack them for "tentative d'intimidation", and another one with Libel (atteinte a l'honneur)

3/ ???

4/ Profit!

Finally, justice.

[Anthony Boyd]

<cynicism>
I have no sympathy for terrorists. I'm glad this company is protecting us.
<cynicism>

But...

[warrax_666]

I believe Rice's Theorem only applies if your computational model allows for infinite storage (or something equivalent).

Computers don't have infinite storage, so you could theoretically map out all possible states that a computer could be in and get a proof of termination (or any other property) that way.

Obviously this isn't practical by any means, but that's no excuse for being imprecise. :)

Re:Look on the bright side...from another french..

[Petronius]

Mon conseil:
- marrie toi a une americaine
- prends la citoyennete US
- ne retourne jamais en France

(ou la meme chose avec une Canadienne si tu aimes la neige).

your rights in cyberspace

[N3wsByt3]

Your rights may become even far less, if the EU gets away with it's latest round of internet-despotism.

Soon, scientists and others all over europe may become sued when exposing flaws or reverse-engineering stuff. I therefor urge everyone to react, and this is how:

*PLEASE HELP TO WIDESPREAD*

14-15 April 2004 : Brussels is the Hub to go

Conferences and LUG in Brussels European Parliament Chaired by Dany Cohn-Bendit MEP

http://plone.ffii.org/events/2004/bxl04

http://www.greens-efa.org/agenda

http://laurence.domainepublic.net

Most legal frame related to new technologies is cooked up at Brussels. To get a feet into European Parliament's door and show that you care right before the election. Its future Members will decide on the patentability of software, on data privacy issues, TPRM, and so on), join an install party within parliament (and bring your favourite MEP with you), attend a panel with eg Alan COX, Georg GREVE, Jon Lech JOHANSEN (of decss fame), participate in a guided tour through brussels (anti-swpats "demo"), meet LUGs and programming rights groups from all over the place, and some chaotic nerds of FFII. A Wiki DSL connection will be available.

On 14 April evening, there will be a diner/party at restaurant La Tentation, in the center of Brussels. http://plone.ffii.org/events/2004 (also to book you hotel).

Entrance is free however to access the building you have to register online before 7 April http://www.greens-efa.org/agenda

Contact : lvandewalle@europarl.eu.int

euroG/LUGparty

Brussels European Parliament room ASP 1G2

15 April 2004

The Greens in European parliament invite representatives of GNU/Linux Users Groups of the 25 Member States of the European Union to come to Brussels to

- enhance the networking among the free software community in Europe(in particular with the New Member states)

- prepare the second reading on the software patents directive

- show inside EP what free software is, how it works and what ideas lie behind

- participate to the FFII conference and demo against software patents on 14 April

Programme and registration on http://www.greens-efa.org

lvandewalle@europarl.eu.int

PROGRAMME

9.00-11.00 25 G/LUGs for a Free Europe

Gathering European GNU/Linux Users Groups and associations for the promotion of free software : BxLUG - Belgium, RWO - Plug - Poland, Vrijschrift - The Netherlands, LiLux - Luxemburg, FFS Software - Austria, APRIL - HNS-info.net - France, GUUG - Germany, SSLUG - Sweden&Denmark, LUGOS - Slovenia, Debian - Latvia, AKL - Lithuania, LugRoma - Italy, Grece, Cyprus, Finland, Estonia, ...

11.00-12.30 Linux Install Party for MEps with Monica Frassoni Dany Cohn-Bendit, Hiltrud Breyer, Bart Staes, ... organized by BxLug

15.00 PANEL I: FAIR USE/COPIE PRIVEE

Gwen Hinze(Electronic Fronteer Foundation), Laurence Lebersorg(Test-Achat Belgium), Jon Lech Johansen(DVD-Jon)

16.00 PANEL II: FREE/OPEN SOURCE SOFTWARE

Cristiano Paggetti(Italy): eGovernment,Andrea Glorioso (Italy) : Free Content, Herman Bruynickx(Belgium): Free software in education, Jens Muhlhaus(Germany): Public administration: Linux fur Munchen

17.00 PANEL III : FREE AS IN FREEDOM

Georg Greve, FSF Europe (Germany) Agenda 1910

17.30 Alan Cox www.linux.org.uk co-signatory of the letter sent by Linus Torvalds to the President of EP against software patents(UK)

Cue conspiracy theory/tinfoil hat cliches

[Catbeller]

I've mentioned it, over and over on various fora since 9/11: anti-terrorist laws were not written to prosecute terrorists.

All over the world, these travesties are now in place. For "evil to succeed", now all that is required is to redefine "terrorism". And we're well on the way for that: now reverse engineering is "terrorism". A marijuana smoker is a terrorist. Someone who criticizes the American government, like Bill Maher, can be advised to "watch what he says". Eventually EVERY infraction can be redefined as terrorism. The ground's the limit.

For the life of me, I cannot see the difference between the Red Nightmare so feared for the last century by the Right, and what the Right is building for us now. Besides a lot of wealthy people and the option to own your own property, what is the real difference between the old Soviet empire and the Brave New World being built by our new jailors?

What we're witnessing is a anti-civil rights movement across the world. The various governments and police/military/spy boys are in the middle of building a new system of law only tangentally related to English common law and the American constitution. They are creating a new world of harsh law unbounded by the rights of man. Altho as many have noticed, corporations aren't men, and aren't bound by any of these new paradigms.

I don't have to even bother finding examples anymore. It's happening every day. Faster and faster, impossible to monitor because it's happening too fast for a single human mind to keep track of it all.

The "terrorism" war is a crock. They aren't using these spiffy new un-laws to capture bombers and the other usual stereotypes. They're using them against US.

Once again

[KalvinB]

stop going through the wrong chain of command with these issues.

First you take it to the company. And if they won't listen you take it to the authorities and they can decide if the company is defrauding their clients with false promises and whatnot. And if they won't listen you throw your hands up in the air and unless you know a company personally who uses the software you just let it go.

Making it public information just makes the danger to the companies very real and very much now which in fact punishes them by not giving them time to deal with the issue.

Unless you have a feasible immidiate solution to go with your findings all you're doing is sabatosing a lot of innocent companies who had no way to know and you've just tied their hands behind their backs and made them sitting ducks. Companies cannot just shut down software at a moments notice.

And here's a nutty idea, if you're really obsessed with finding holes in a certain company's software seek a job. The obvious problem is that you're a problem person. You find problems and that's it. That doesn't help anybody. And when you then blackmail people with this information by going public if they don't deal with it, no duh you're going to get in trouble.

If you're sincere about helping the company you find the problems, find the best solutions you can with the information you have and then go to the company and explain the situation and tell them you'd like to help and know how to fix the problems but need access to the source to do so. You then request a job as a programmer and get to work if they hire you. If they don't hire you, you leave them with your findings and move on.

If you ever, in the process of these discussions, even hint at going public it's called blackmail and you'll rightfully be thrown in jail. Give one copy of your findings to the company and one copy to the proper authorities. That's it.

By pressing the issue you assume you have some kind of right to tell the company what to do. You also assume that the company isn't working on the issue. And you also assume that the company owes you some kind of update on the status of the issue. Which are all three very wrong assumptions unless you actually work for the company and are in an upper position. By going public you've basically forced the company into a bad position because they didn't act in a time frame you thought was fast enough. You don't have a right to do that. DMCA or not.

If you don't have a feasible immediate solution to go with the problems you've found going public is just hurting everyone and helping no one.

If this is something you like to do, you should have gotten a job so that you'd be recognized as a legitimate software security expert that companies can hire for testing their software. But now you've kinda screwed yourself because nobody can trust you to work within the system. Your mouth is too big for the job.

You've made yourself singularly responsible for anything bad that happens because of your findings. Instead of an "I told you so" you would have earned by going through the proper channels you earned an "it's your fault." Because you assumed anyone could have found and exploited the problem and now they can.

Let the bad guys go public. If you have no solution and you go public without permission, you are the bad guy. With Open Source you have all the permission in the world to report hacks without posting solutions. Work on Open Source if you can't stand keeping secrets.

Ben

Re:Once again

[nate1138]

stop going through the wrong chain of command with these issues

What chain of command? If this company isn't paying his salary, he has NO obligation to tell them shit.

punishes them by not giving them time to deal with the issue.

And do you argue that companies that make claims like "catches 100% of known and unknown viruses" don't deserve to be punished for blatantly lying to the public?

all you're doing is sabatosing a lot of innocent companies

See the above point

The obvious problem is that you're a problem person. You find problems and that's it. That doesn't help anybody.

You don't think that finding problems in software that people rely on is helping? Would you prefer that people continue on with the illusion of security where none acutally exists?

If you ever, in the process of these discussions, even hint at going public it's called blackmail

Now there's the uninformed legal opinion I have come to expect from Slashdot. It's not blackmail unless you ask for money. Going public is pretty much standard practice in the security biz.

And you also assume that the company owes you some kind of update on the status of the issue. Which are all three very wrong assumptions unless you actually work for the company

So their customers have no right to status updates on problems with a product that they have purchased?

Go home and read a book

Re:Look on the bright side...from another french..

[Mateito]

> marrie toi a une americaine

I thought you were trying to make this guy feel better?

What's he going to do, chance his place of birth to "Freedom"?

Re:Look on the bright side...from another french..

[Anonymous Coward]

Becoming an American citizen won't help you. We have this nasty piece of merde called DMCA that provides for hefty fines. A company that doesn't like you can point to DMCA as a vehicle to charge you under.

I agree with the previous poster, a good offense is the best defense. Hit them hard in the court of public opinion, and if it is indeed true that you cannot punish someone in France for telling the truth, then by all means, hammer away.

Re:Look on the bright side...from another french..

[valmont]

Bien vu tout ca!

Is "Arte", channel 5 still around? I'd definitely give these guys a call. While their audience is prolly a small fraction of France 3's, they're usually an educated audience. They like doing documentaries, seek out truth and present things as they are. i couldn't find any direct contact information beside this mailing address:

ARTE G.E.I.E.
4, Quai du Chanoine Winterer
F-67080 Strasbourg Cedex

I'd do whois arte-tv.com and send an email to the contact info on there, you never know.

Bon courage vieux! Fous-leurs une grosse bite au cul de ma part, avec mes remerciments ;]

Re:Terrorist??? Sounds like libel to me.

[B3ryllium]

The ironic thing is that if he had told the company before he released the exploit, they could probably have been able to charge him with the French equivalent of Blackmail.

It kind of brings a whole new meaning to the saying, "you're damned if you do and damned if you don't."

All the more reason...

[MImeKillEr]

..the loser in the next world war has to keep France.

Hey - maybe we say the French gubmnet is supporting al Quida and use this as an excuse to invade and set up a puppet government.

Wait. Nevermind. I guess we can see it already has one.

Bring Back Fully Informed Juries!

[spun]

See the American Jury Institue/FIJA page for more info. We need juries that also decide whether the laws are valid, not just whether they were broken. That is the whole reason we have juries and not 'Star Chambers.'

Re:Hmm

[vrt3]

My council (advice):
- Marry to an American (woman, -in postfix like in German?)

Correct.

- Pretend you're a citizen of the US

I think: Get the US nationality.

- Never return to France again

Correct

Though I have no clue what the last one means, apart from mentioning "with a Canadian". Any better translators than me? :) And why the US? With the DMCA, isn't that going from the frying pan into the fire?

"Or the same thing with a Canadian, if you like the snow."

Translation

[SeanDuggan]

I haven't spoken French since High School, but I think this is doable:
My advice:
- Marry an American girl.
- Acquire a US citizenship.
- Never return to France

Or do the same thing with a Canadian girl if you like snow.

DMCA? France?

[Mistlefoot]

Even if he did break the DMCA, he was charged in France.

The US is not the World.

The root of the problem

[spood]

This paragraph really hit home:

There is something very strange when you are in front of the judge who is doing the preliminary investigation: we do not speak the same language. I'm unable to understand law jargon, and the person in front of me does not understand anything about computer security and the internet. The lawyer is supposed to be the translator. But the lawyer in this case cannot speak during my declarations. It's kind of weird. You have to find a good argumentation, try to explain in simple words complex methods, how programs work, try to show that the accusations of the company are basically void.

Justice is supposed to be blind, but not the judges. I think that is the single biggest problem we face with existing computer crime legislation - neither the legislators nor the judges understand what it is that the law is actually saying.

BTW, I really enjoyed your steganography articles. It's comforting to realize just how difficult it is to implement stego correctly. It really puts mainstream media hand-waving about terrorist use of steganography into perspective.

Yes of course

[niom]

Because we all know this could never have happened in the U.S.

No other side

[greppling]

Unless he is lying extremely grossly (about which we would have gotten to know about it by now), I really cannot see how there can be a "other side" that is worth hearing.

I read his originial analysis (in french) of this antivirus software which, according to him, prompted the charges of "counterfeiting". This article contains a description of the software, a section about "exploits" (you will agree about my question marks in a minute), a section where he demonstrates false positives, a test against a couple of known viruses, a short section about 2 points he liked about the software, then a list of detailed suggestions to improve the product, and finally an epilogue on the response from the company.

Probably didn't like the first suggestion for improvement "First of all: stop making believe that Viguard can do miracles." (The other suggestions are completely technical.) But let's focus on section 2, containing the 6 "exploits":

• 2.2 Deactivating Viguard by simulating the mouse-clicks with which a human would deactivate it
• 2.3 Just use TerminateProcess() (the windows equivalent of kill -9 if I understand correctly)
• 2.4 Add the md5sum of the trojan to an (unencrypted) whitelist of md5sums maintained by Viguard
• 2.5 In each directory, Viguard maintains a file "certify.bvd" which lists all known-good executables in this directory, "encrypted" by a XOR with a fixed key. So a virus just has to install itself in a new directory along with the appropriate certify.bvd file.
• 2.6 "For a good laugh": Rename a virus from .exe to .bat
• 2.7 Almost the same as 2.5.

All completely trivial. The only thing that comes close to the counterfeiting charges is that he offered programs for download that decrypt the configuration file and the certify.bvd files (both "encrypted" by XOR with a constant and short byte sequence).

Same country, similar case (?) : Serge Humpich

[christophe]

A few years ago, Serge Humpich discovered a flaw in the French smart-card payment system, and proved that it was possible to get money from an ATM with a false card ; he never earned money with it and just showed journalists he could get money, and gave it back.
Banks sued him, and won: 10 months jails (deferred), about 4000 euros to pay (amends+banks' laywers fee). Technically, he was guilty of "unallowed access to a computer system". Banks have denied that the flaw existed but changed their system ; it didn't prevent many false cards to appear in the following years. Disgusted, Humpich wrote a book ('Le Cerveau Bleu').

Although similar, I hope it won't finish the same way. Guillermito didn't crack any computer, so the Humpich precedent does not apply. The European version of the DMCA is not yet voted in France (it won't last), and copyright infringment claims are stupid. But America does not have the monopoly of technically illiterate judges, and he influence of good lawyers, as was already shown in his case. The "terrorist" accusation should be enough to sue ("diffamation"). Ironically, cryptography and stenography are supposed to be terrorists' tools!

I'd say he should contact "60 millions de consommateurs" and "UFC-Que Choisir", two powerful consumer organizations.

Re:Harvard? I think not.

[dr bacardi]

Here, read it in french (his native language) and see if it flows better.

Re:Harvard? I think not.

[flossie]

These are incredibly competitive institutions; they would NOT bring onboard someone with that kind of spelling and grammar.

His English spelling and grammar are significantly better than my French spelling and grammar. You did notice that he is French, didn't you?

actual text of the indictment?

[bani]

is a link to the actual text of the indictment anywhere? without it we won't know exactly what the claims are, and only have his version of the story to go on.

The DIY Cruise Missile and freedoms

[NewtonsLaw]

The NZ government has gone out of their way to try and destroy my life since I publicized the risks associated with home-built cruise missiles.

I still have my missile (largely due to the fact that a network of friends have stored it safely in such a way that I can honestly say "I have no idea where it is") and had considered taking it on a tour of the country so that people could actually see what I've been talking about.

My lawyer advises me however, that to do so would almost certainly result in a very severe prison term. After all, they've already broken the law in respect to the actions they've taken against me so they've proven that, as far as they're concerned, the ends justifies the means.

He's strongly of the opinion that the government is just itching for an excuse to throw me in jail on some trumped-up terrorism charge because I've become such a thorn in their side.

In this country It's not illegal to build a cruise missile, and it's not even illegal to own one, nor is it illegal to transport one -- but, as a criminal lawyer of long standing he made it quite clear to me that under the new anti-terrorism laws we now live in a police state and that the government can do whatever it wants to who-ever it wants to -- by simply accusing them of terrorist activities.

In the case of my tour, they'd likely accuse me of moving the missile as the precursor to a terrorist action.

It wouldn't matter whether they were able to win such a trumped-up case, because here in NZ (as in the USA), people accused of such things seem to spend inordinately long periods of time in jail just waiting for their case to come to court. We have a guy here who's been in prison for 16 months already and, even though our High Court ruled just the other day that the head of our Security Inteligence Service had shown bias against the guy and has had to resign -- the imprisoned "suspect" is still having to wait at least another 6 months for his day in court.

It makes no difference apparently, that I've always been totally open in my activities and the reasoning behind them, and was planning to have a media contingent on my little tour. I don't recall any *real* terrorists inviting the media along on one of their attacks or offering to share all their information with the government.

I don't know whether I should really angry that governments have used the war against terror to give themselves such draconian powers, or if I should feel sad that the public are allowing them to do this without even a whimper.

I suspect that we will eventually regard these days as a dark period in the world's history -- not because of terrorist activities, but because so many people gave up so many freedoms so easily.

P.T. Barnum was right I'm afraid :-(

counterfeiting

[Chep]

The creation of an unauthorised copy of a copyrighted work, in French law, is a form of counterfeiting ("you are creating illegitimate goods"). This just means he's indicted for a copyright violation and an attempt to conceal that he (allegedly) did.

Tough time for the guy. I hope he did things the right way (ie. that the allegations are proven false or falling within fair use), and has enough juice in the bank to countersue and prevail for his costs.

Re:Look on the bright side...from another french..

[fbonnet]

I Television also has a pretty good local coverage, but less audience than France 3. I'd also suggest writing to Le Canard Enchaine, which has a dedicated column for this kind of stories ("Couac").

I'm not as optimistic as the previous poster, remember what happened to Serge Humpich. This guy found a way to crack the so-called most secure bank card system in the world (french Carte Bleue). He then contacted the system's proprietor (GIE Cartes Bancaires), offering help (not freely, alas for him) to fix the system thanks to his expertise, and as a demonstration bought a handful of metro tickets. He was indicted, temporarily jailed and found guilty of fraud, falsification and unauthorized access to an automated system. During the trial GIE kept on claiming that their system was unbreakable, yet some time later the first "Yes-cards" appeared on the black market and cracking info spread on the Net. Had the GIE taken Humpich seriously, no yes-cards could have been produced and no businesses harmed (usually small ones such as automated video cassette rental).

Merde pour la suite (frenchmen never wish good luck)

Re:Look on the bright side...from another french..

[Bun]

" The first comment recommended hiding from his accusers instead of fighting them."

Actually, he recommended going to America, finding an American, (or Canadian - if you like snow) girlfriend, and marrying her for the citizenship so you could live there. It was funny.

"The second post agreed, and bemoaned the sad state that France is in these days, and how much nicer of a place to live the USA is."

Nope (or are you trying to be funny?). The second poster asked him why he would want to live in the USA when everyone in the world detests its citizens, when it has a government with a president that caters to rich people and their companies, etc., etc... He then said it was better to go to Canada, which is a thousand times more sensible than the USA. (I'm paraphrasing here, since my French isn't so good these days.)

Re:Look on the bright side...from another french..

[kubrick]

"Arte" ... They like doing documentaries, seek out truth and present things as they are.

This is the same station that did the documentary about how Stanley Kubrick faked the moon landings for the Americans... screened here on April 1 a couple of years back, and from that link looks like they'll be playing it again very soon. :)

legal systems, insurance

[hak1du]

It's quite interesting to discover, from the inside, how the french justice system works. I'm back from Paris. I've just been indicted and charged of distributing programs that violated Intellectual Property rights (literally translated, it's "counterfeiting and concealment of counterfeiting"). Maximum punishment for these charges are two years in jail and a fine of 150.000 euros. I'm not yet judged guilty or innocent, but I already had to pay around two or three thousands dollars for two trips to Paris (I live in Boston, MA, USA), plane tickets, and lawyer fees. I already talked about my story here (in french).

That's the way justice systems work in general: if someone accuses you of a crime and makes what looks like a reasonable case to the police, it ends up costing you money. Welcome to the real world. Life sucks sometimes.

If it's a civil complaint, in some countries, the people sueing you may have to pay your expenses if they lose, but that's also not exactly a blessing--it also means that if you have a complaint against someone else, you may end up paying them a lot of money if you lose--a strong disincentive to enforcing your rights when you have been wronged.

In Europe, many people have private legal insurance, which will pay for legal fees and lawyers when you get sued; something like that might cover this case. Many people who work professionally in some field also get professional insurance, which also often covers them against lawsuits. So, the short answer is: in order to avoid getting bankrupted by frivolous legal claims, people insure themselves.

If you have been falsely accused, your accuser may have committed a criminal offense themselves and you may also be able to recover damages in civil court. However, in a case like this, that may be too hard to prove even if it is obvious to you and me.

If independant researchers cannot analyse security softwares and publish their discoveries, final users will just have marketing press releases from editors to assess the quality of a sofware. Unfortunately, it seems that we are heading to this kind of world in France and maybe in Europe.

No, it just means you have to go about exposing their product differently. Publish an article in a respected publication. Then, they'd have to take on the publisher.

Or file a complaint against them for false advertising. That could be either a complaint to an organization like the Better Business Bureau (or the French equivalent), or an legal complaint.

It may still be worth filing a counter-complaint at this point. You need to talk to a lawyer about that.