Australian Police Given Power To Use Spyware

reek writes "An Australian newspaper has reported> that the contentious Surveillance Devices Act has been passed. The act will (according to the article) allow Federal Police to obtain warrants to secretly install spyware onto users computers enabling them to "monitor email, online chats, word processor and spreadsheets entries and even bank personal identification numbers and passwords.""

Comments

A Good Thing?

[fembots]

Now that this Surveillance Devices Act allows police to obtain a warrant, does that mean that information obtained unlawfully won't stand in the court?

I vaguely remember there's a country where it is illegal to obstruct surveillance by way of encryption. And you may be required to hand over all your passwords (if some are protecting legal documents like a Will) if the police decided to take a good look at you.

I can imagine a police listening to a phone conversation interrupts the suspects and requests them to speak in plain English.

Re:A Good Thing?

[Tackhead]

> Now that this Surveillance Devices Act allows police to obtain a warrant, does that mean that information obtained unlawfully won't stand in the court?

Information obtained unlawfully never stands in court. Because the Constitution is a living document that must be updated to take into account changing technologies, however, the definition of "unlawful" must change.

In brief, "Anything not nailed down is ours. Anything we can pry loose is not nailed down!"

Meantime, the US has had this since 2001, so it's not like Australia's move towards normalizing law enforcement techniques to modern standards is anything new.

Re:A Good Thing?

[Blue-Footed Boobie]

I use really long passphrases when I encrypt my data.

I also use 448bit Blowfish encryption.

If I forget my passphrase, no matter how pissed the cops ge, it doesn't really make a difference.

Now, if their spyware had keylogged the phrase the last time I decrypted....

Re:A Good Thing?

[Anonymous Coward]

In China, a couple on the phone were interrupted and told to continue their conversation later, as the current "eavesdropper" was about to take a lunch break.

Re:A Good Thing?

[myowntrueself]

"I vaguely remember there's a country where it is illegal to obstruct surveillance by way of encryption."

The UK, I believe?

Where its illegal to 'possess any information which might be useful to a terrorist'

Re:A Good Thing?

[zfusion]

I personally don't like the idea of the government using spyware but it is similar to wiretapping. My concerns are the following:

a. Would a corporation (MS) work with the feds to allow this software a backdoor to bypass security and be easily automatically installed on the system?

b. What precautions would be made to make sure this software didn't end up in the hands of others and spyware companies?

c. How are they going to get around more savvy users if firewalls are installed on the systems being monitored?

Not that I am looking to commit any crimes, but from things I've seen in the news lately, I worry about the future US government or any government abusing it's powers. On another note .. from what I hear about China, I could imagine hearing about the government there trying to implement this on all systems to try to make sure the average citizen isn't exposed to anti-communistic web material.

Re:A Good Thing?

[Anonymous Coward]

Oh Crap, there goes my sears catalog.

Re:A Good Thing?

[alw53]

The Constitution is a "living document" that must be updated to take into account changing techologies, terrorism, drugs, kiddie porn, secret regulations, secret warrants, etc, etc. In other words, its a dead document.

Re:A Good Thing?

[Anonymous Coward]

"I vaguely remember there's a country where it is illegal to obstruct surveillance by way of encryption. And you may be required to hand over all your passwords (if some are protecting legal documents like a Will) if the police decided to take a good look at you."

Most countries are like this, but the UK is one of the most famous.

Re:A Good Thing?

[Anonymous Coward]

Where its illegal to 'possess any information which might be useful to a terrorist'

The alphabet.

Re:A Good Thing?

[MasterOfMagic]

a. Would a corporation (MS) work with the feds to allow this software a backdoor to bypass security and be easily automatically installed on the system?

If the Feds came to them and said, "You know, if you want to keep doing buisness, we need this from you," you can bet that they would do it. Microsoft is a corporation, and corporations exist to make money, so it's safe to assume that they would cooperate. (One side note: It's not like these sort of hooks need to be added. Internet Explorer seems to pick up spyware just fine.)

b. What precautions would be made to make sure this software didn't end up in the hands of others and spyware companies?

There wouldn't be any precautions taken. My guess would be that the security holes that are exploited to install and setup this spyware would be the same as any other spyware - meaning that the police are learning from existing spyware authors, not the other way around.

c. How are they going to get around more savvy users if firewalls are installed on the systems being monitored?

They'll install backdoors on the firewalls, of course. The same tactic that might get Microsoft on board would get major network companies on board and software firewall makers on board. Rinse and repeat.

I've said this before, and I'll say it again. The only computer that can't be spyed on is one that is turned off, unplugged from everything (including the wall), and buried under three square kilometers of concrete.

(Note: I'm not saying that there aren't secrets you'd like to hide, but a computer connected to the Internet is not the place to hide them.)

Re:A Good Thing?

[Anonymous Coward]

a. Would a corporation (MS) work with the feds to allow this software a backdoor to bypass security and be easily automatically installed on the system?

Of course they would. You know, like how copiers&printers won't print US currency?

b. What precautions would be made to make sure this software didn't end up in the hands of others and spyware companies?

This software exists already. You can download free versions of various "security" tools. They just want permission to secretly install it.

c. How are they going to get around more savvy users if firewalls are installed on the systems being monitored?

If the information is valuable enough, they could employ hackers/crackers to try to break in. Otherwise they're out of luck using these methods, but there's still plenty of other options.

Re:A Good Thing?

[paganizer]

Is it really worded that way?
"illegal to 'possess any information which might be useful to a terrorist'"
Man, I would be SOOOOOO screwed.
My old shadowrun and twilight:2000 sourcebooks alone would get me put under a jail.
If they saw the stuff I used to play with as a kid (in the 70's) they would shit all over themselves.

Re:A Good Thing?

[Le Marteau]

If I forget my passphrase, no matter how pissed the cops ge, it doesn't really make a difference.

I hope you can still say that when your cellmate starts referring to you as 'Shirley'.

Re:A Good Thing?

[Aeiri]

They'll install backdoors on the firewalls, of course. The same tactic that might get Microsoft on board would get major network companies on board and software firewall makers on board. Rinse and repeat.

I doubt they will be able to convice the netfilter/iptables people to create a backdoor...

Re:A Good Thing?

[Anonymous Coward]

The overwhelming popularity of prison rapes is a US thing. When MTBGOJ is considerably less than a lifetime the rapist runs the risk of being labelled gay in the real life.

Re:A Good Thing?

[Anonymous Coward]

"Ours is a better world."

Re:A Good Thing?

[MasterOfMagic]

First of all, what's to say that there isn't one already, and second of all, what's to say that someone can't add it? The netfilter people have good intentions, but they're human. What if someone accidently accepts a patch that contains a backdoor? Then the backdoor sits there until somebody discovers it. I'm not saying that it's bound to happen - I'm saying that it could happen. Furthermore, that perhaps the Feds would like to make it happen.

Of course, your point is that perhaps the user is smart enough to spot the backdoor in the firewall and remove it, creating a fixed version. That's all good and well, but what happens if your C compiler has a backdoor that puts the backdoor back in the firewall when it's recompiled? Then your work is for naught.

Re:A Good Thing?

[Asphixiat]

ASIO has been able to this this for quite a while, I think the laws got passed, but weren't released for like 2 years after the fact....? The is a /. article someplace for sure.

Anyways, I don't like it, but I guess they can probably already get that kind of info from the ISP. So as long as they have to get a warrant to do it, they still have to convince a judge its alright *shrugs*

Re:A Good Thing?

[Sique]

But then your compiler has to determine that the code you are compiling is actually a netfilter (or similar) code. Otherwise the compiler has to put in the backdoor in about every piece of software it is compiling. And then the backdoor should reside in a part of code that is quite probable to be executed during the program's lifetime.

Mr. Kernighan's "backdoor compiler" is all well and neat as a theoretical concept, but the reality is something different :) To realize it you have to put a lot of artificial intelligence into your compiler, and you should make sure no one ever wants to profile the code it is compiling, otherwise it will show up in the debugger. And infecting the whole tool chain from compilers and script languages up to profiles, debuggers and trace programs could prove quite complicated even for a determined party.

Re:A Good Thing?

[badmammajamma]

lol...I like his workaround to the UK law.

Re:A Good Thing?

[jc42]

So it's now illegal in the UK to possess a street map of London?

After all, such a map could be very useful to a terrorist intent on terrorizing some place.

I was over there a few months back, and I saw lots of street maps for sale at the airport. I wonder if those vendors have been arrested yet?

Re:A Good Thing?

[Anonymous Coward]

I went to your website, created in FrontPage, by a Microsoft Certified Engineer. Dude, I think you're giving pagans and libertarians a bad name. Not sure about the pagan part, but what part of Microsoft's corporate policies in any way align with libertarian principles?

Re:A Good Thing?

[Anonymous Coward]

The Constitution is a "living document"???

What?

Is is moldy or something? Got worms?

Or is it just your copy?

And pi=3 too, right?

Or is just your copy of pi?

Re:A Good Thing?

[Anonymous Coward]

"So it's now illegal in the UK to possess a street map of London?"

Oh you may laugh, but it's happened. I can't find a web link, but it was a newspaper headline last year, someone being arrested for having a map of london, a pair of binoculars, and some other amusing household item I can't remember. Presumably the map had whitehall circled in red or something...

The obvious google search just reveals the "moroccans arrested with a map of london", but that's a different incident, and that group actually had explosives, according to newspaper reports.

Re:A Good Thing?

[Anonymous Coward]

If the information is not acceptable in the court - that's a good thing I guess, but who watches the watcher. I don't imagine that Australia doesn't have any dirty cops. Won't civilian rights be violated? This type of law could help turning a country to a Totalitarianism government!

Re:A Good Thing?

[Anonymous Coward]

Most pagan beliefs aren't compatible with believing that Bill Gates is the only God.

Re:A Good Thing?

[Anonymous Coward]

HA HA, dumbass aussies.....that garbage won't wash here in the US.......we hackers won't stand for it.......!

Re:A Good Thing?

[Anonymous Coward]

They always had the power to intercept communications under warrant under the Telecommunications (Interceptions) Act. What this new legislation does is add surveillance of the computer itself, not the network tx/rx. That way they catch non-net transmitted information, such as letters, financial accounts, etc.

As far as on-line banking passwords, and the like, they have been doing this for years.

Interestingly enough, if An Agency wants to look at the body of your email, it takes two warrants - a search warrant for read email, and an interception warrant for unread email. If they only wanted to look at the headers, it was search warrant only. Thank you, Federal Court.

Yes, I did it for a living until recently, and played around with the proof of concept. And I can already guess that a "target" who is aware of what is going on is not going to be using Windows- way too easy.

Re:A Good Thing?

[Paracelcus]

How's about booting from a read only CD like Knoppix or Tom's RTBT and saving via an encrypted tunnel to an overseas secure share or a tiny USB keyfob drive?
then you could put it in a mayonnaise jar and bury it somewhere!
And of course if you must use the phone be sure to tell the other party that it's being bugged so the flatfoots (flatfeets?) know that anything you say is probably bullshit for their benefit.

"just because you're paranoid doesn't mean that their NOT after you"

Re:A Good Thing?

[oz_canetoad]

Thanks to the FTA with the good ole US of A, free as in beer, we now have your patent laws, and we all know how good they are. And now you tell me that this whole spyware infest a computer to catch illegal activity is a good thing? I would suggest that our Federal Police pull their finger out and get a better clue to computer forensics then introduce laws that are knee jerk, as we are now discovering with the enforced copyright law changes thank to our "Free Trade" agreement.

I regret to inform you that I see no good from mimicing the US when it comes to law matters, nor internal security, the once land of the free has now become the land of deiminishing rights and sadly little Johnny Howard (our Prime Minister) thinks it is a good idea to follow suite, and the opposition party who just got handed a humiliating defeat in the election are most inaffective when it comes to arguing policy.

We already have laws that require ISP's to store mail and access logs, I see no reason to allow invassive surveillance of computers when they could just as easily monitor and trap all traffic at the isp end, this would be near on immpossible to detect.

Re:A Good Thing?

[JudgeSlash]

a. Would a corporation (MS) work with the feds to allow this software a backdoor to bypass security and be easily automatically installed on the system?

Too late...

How NSA access was built into Windows http://www.heise.de/tp/r4/artikel/5/5263/1.html

Re: A Good Thing?

[the.aham]

Might I add to this list:

d. What if any average person on the Internet, with nothing to hide, makes comments online that are considered political or promoting racism when they really were making a totally different point? Would such comments, made purely in historical context, make the aforementioned average person a target and put them on some high-risk list?

In other words... what about _opinion_?


Perhaps extreme, but here's a real-life example I thought of:

Suppose UserXYZ is a great law-abiding citizen and free-lance historian-buff, cherishes Democracy, and enjoys socializing with all people everywhere regardless of race or creed. Suppose that UserXYZ also has a fascination with powerful/most influential people in history. Nothing wrong so far, right?

Well, what if in an online conversation about "influential people in history" UserXYZ makes a comment about the influence of Germany's famed leader prior to and during WWII? UserXYZ could go on to say that Adolf's influence was so powerful that Adolf was able to convince both his millions(?) of followers and then members of other countries to support his cause --> From what has been mentioned in various treatises on such topic (from Discovery, National Geographic, History Channel, etc), it appears that Adolf's agenda stemmed from his personal bias against certain groups of people.

IMHO, UserXYZ:
- Did NOT make comments promoting racism
- Was making a totally different point (perhaps more of an opinion), simply that Adolf was a very influential leader in his time for certain groups of people. That's it.

So... back to "Australian Police Given Power to Use Spyware || RE: A Good Thing?" Where will the Australian (or any) government draw the line between someone with genuinely malicious intent and someone who is just presenting a piece of information (eg: an OPINION)? Given the characteristics I mentioned earlier of UserXYZ, I don't think UserXYZ honestly meant to be malicious... though some countries might see it as so.

Of course, the example presented is rather specific and the topic is somewhat taboo. And, I could've been wrong in presenting some facts on Germany's leader, as I am not a historian.

Maybe this entry was indeed a bit daring, though I also worry about the government abusing it's powers.

Thoughts on determining that borderline between truly harmless opinion and genuine malicious intent, anyone?

For the record --> This user's intent - simply presenting a different cause of concern. An Opinion. ::grin::

Re:A Good Thing?

[Anonymous Coward]

c: obviously you will get a notice to take down your now illegal firewall.

Re:A Good Thing?

[myowntrueself]

Indeed, the UK has effectively banned all knowledge.

Re:A Good Thing?

[arevos]

Where its illegal to 'possess any information which might be useful to a terrorist'
I wouldn't be surprised if this was the case, but do you have a source?

Re:A Good Thing?

[NetNifty]

Seems so.:

"Section 16B of the PTA makes it an offence in England and Wales and in Scotland to collect, record or possess any information which might be useful to terrorists. This provision too applies to both Irish and international terrorism. Equivalent provision is made for Northern Ireland in section 33 of the EPA. This offence is designed principally to catch those compiling or possessing targeting information. Lord Lloyd notes that the police have found the offence particularly useful in Northern Ireland and he recommends that a similar offence be included in any new legislation against terrorism. Again the Government agrees. As terrorist groups try to obtain information on the movements of their potential and actual targets and to gather any other information which might assist them in mounting an attack, the existence of this offence can help the police and the security forces to disrupt such terrorist attacks. "

Is it me or does this seem like a license to arrest anyone anywhere for any reason? "A recipe for a cake? That could be useful to terrorists!"

Re:A Good Thing?

[amber_of_luxor]

I worry about the future US government or any government abusing it's powers.

Trust the US Government

to might 1984 look like a Pacifist, Libertarian regime.

Amber

Re:A Good Thing?

[ColaMan]

If I forget my passphrase, no matter how pissed the cops ge, it doesn't really make a difference.

There's this thing called 'contempt of court'.

Prosecutor : "Well, would you please tell us the passphrase to your files."
You: "I forgot it (grin)."
Prosecutor : "But our surveillance shows you opened that file yesterday, and 5 times last week. And yet, you forget?"
Magistrate : "Defendant, it is obvious that you know your passphrase. Please reveal your passphrase to the court."
You : "I forget (grin)."
Magistrate : "Very well. Three months in jail for contempt of court. This session will resume at a later date."

Re:A Good Thing?

[mallie_mcg]

as we are now discovering with the enforced copyright law changes thank to our "Free Trade" agreement.

Research my lad, research. If you decide to go and do some research what the FEDRAL copyright laws brought in by the F.T.A. have to do with the ones decided on by the STATES. As I understand it the copyright aspects of the FTA dont mean squat to most Australias and the federal government cannot mandate legislation to the states, ergo its mostly irrelevant that the old/existing laws will hold.

Patents on the other hand....

Re:A Good Thing?

[oz_canetoad]

http://www.aph.gov.au/library/pubs/CIB/2004-05/05c ib03.pdf

More on copyright.
http://www.ilaw.com.au/public/ftaartic le.html

Google is your friend.

If you honestly believe that the changes will have little to no effect on everyday Australians then you are obviously not involved in Agriculture, where we lead research in many arenas, Copyright and IP law changes can an will impact this sector.

This dicussion is off topic, but my dissent for the FTA purely based on the fact that it imposes changes to our common law rather than focus on "Free Trade".

The fact that you believe that these changes won't impact on everyday Australians is the apathetic response the government was hoping form the public so not to impact its re-election. The mere fact that the Labor party jumped on the band wagon without any objection just shows the sorry state of affairs within the Australian political system.

Re:A Good Thing?

[miskate]

In Australia, any Commonwealth law, provided that it is within the Commonwealth government's constitutionally assigned powers, overrides any state law about the same thing (s109. "When a law of a State is inconsistent with a law of the Commonwealth, the latter shall prevail, and the former shall, to the extent of the inconsistency, be invalid" - see Chapter V [aph.gov.au], and see Chapter 1 part V [aph.gov.au] for the Commonwealth's powers) I've not read the FTA laws, but in theory any new laws made to entrench it would fall under s51(xxix) - which basically means that they can do anything to satisfy treaty obligations (which for e.g. was used to override the Tasmanian law against homosexuality after the International Human Rights court declared it bad - so it's pretty broad). But they don't even have to go that far - s51(xviii) gives the feds power to make laws regarding "Copyrights, patents of inventions and designs, and trade marks", so while states can legislate to their hearts' content about those things, it don't mean squat if Little Johnny and his chums want to pass a law saying, essentially, "all US copyright, patent and trade mark laws apply in Australia". IANAL... yet

Re:A Good Thing?

[JustAnotherBob]

And after the three months in incarceration without contact with the said file in question, I really DID in fact forget the passphrase, because I was so preoccuipied and pissed the Judge threw me in lockup for forgetting the passphrase in the first place.

Re:A Good Thing?

[MasterOfMagic]

But then your compiler has to determine that the code you are compiling is actually a netfilter (or similar) code. Otherwise the compiler has to put in the backdoor in about every piece of software it is compiling. And then the backdoor should reside in a part of code that is quite probable to be executed during the program's lifetime.

Okay, and how often do most people audit their binaries for this sort of behavior? Could the average user, or even most advanced users, dig through their binaries and notice this sort of change? I think not.

If that's too general for you, how about a C compiler that spits out a backdoor when it notices a certain set of lines? Then, not only netfilter gets backdoored, but any sort of networking code that matches the set of lines. More bang for the buck.

Re:A Good Thing?

[Anonymous Coward]

Okay, I forgot to address something - posting as anon coward. What if your debugger or profiler is backdoored as well so as not to show the backdoor? It's possible, and then the only way you have to know is to look at the generated executable.

The point is that no one piece of software is the magic bullet that can stop you from being spied on. Sometimes it's not even a backdoor that gives the curious party a look at your data - it can be something as simple as a configuration error. The only way to keep data from leaking out of your computer and onto the Internet is to not have your computer connected to the Internet.

--
MasterOfMagic

Re:A Good Thing?

[Anonymous Coward]

Hack the planet!

Re:A Good Thing?

[Anonymous Coward]

If the Feds came to them and said, "You know, if you want to keep doing buisness, we need this from you," you can bet that they would do it.

Well now, you may not like them but they're not that stupid. Today this, tomorrow something else? That would be like giving the gov't a "blackmail MS free" card.

I'm pretty sure they are not going to let someone twist their arm against their will. I mean there was so much enthusiasm to break up MS into 3 little companies. Not even 2! "I'm going to for 3 here Ralph. Let's break MS into 3 little entities." And then? It was pretty much forgotten....

Re:A Good Thing?

[dbIII]

Information obtained unlawfully never stands in court

No problem, a new US legal system is being developed in Cuba since it appears the civil and military justice systems will not always produce the desired result.

Re:A Good Thing?

[null-sRc]

you may be required to hand over all your passwords

i have one word for you: stenography...

"why officer whatever do you mean! these are just my vacation pictures!"

good luck proving theres anything in them :)

Re:A Good Thing?

[Like2Byte]

To hone a very fine point, as an addition to your point, yesterday, I saw a deer roughly 4 meters from the road. It's left rear leg was shattered. I reported it to the local police (via phone) hoping that the animal control officers could come out and either rehabilitate it or put it out of its misery.

While presenting this information to the officer, he wanted my name (including middle initial), address, telephone number and, disturbingly, my date of birth. {{Ugh, rolls eyes}}

I shouldn't have given it to the officer. I should have told them that if they wanted it to send an officer over to get it. Why? I should have realized, then, that nothing was going to be done for the poor animal (that is, treated or humanely put down). All the officers were interested in was who I was - so they could add another arrest to their otherwise drab and boring existance. Happy to disappoint them.

As good-natured people take measures to coincide peacefully within our environment and the more the local magistrate pumps the citizens for information (not relating to the particulars of the case) the more people will tend to refrain from seeking authority figures in the future. I know I will no longer call the police for any reason save threats of violence (not to worry there, though!)

All I wanted was to help a poor animal and I get subjected to a warrent search. Bah! I really do feel spied upon - and I helped them!!

Re:A Good Thing?

[Anonymous Coward]

i don't recall street maps of londen being very useful...

Re:A Good Thing?

[Wocko]

So that would be your secretary saying that then, given she's a stenographer.

Re:A Good Thing?

[Jane_Dozey]

While I agree that the only way to really ensure you do not get remotely compromised is to unplug the thing, I'd like to point out that there IS software that you can trust well enough: the stuff you write on your own. You *could* write a compiler in a low level language so you skip the need for another compiler, and then you *could* use your own compiler to compile the rest of your software. Of course, this solution's reserved for the most paranoid person with the most amount of time on their hands, but it *could* happen. /nit picking

Re: A Good Thing?

[Anonymous Coward]

When you have to mask a reference to Hitler that badly in a slashdot article, you can already tell that things have gone too far.

Then again, I'm posting AC.

Re:A Good Thing?

[xenobyte]

If I forget my passphrase, no matter how pissed the cops ge, it doesn't really make a difference.

I hope you can still say that when your cellmate starts referring to you as 'Shirley'.

I sincerely hope there's no places in the so-called civilized world where it in punishable by prison sentence to forget a passphrase... And even if it is, it's worth mentioning that they can only ask for passphrases they know to exist, which means that 'hidden containers' stay hidden. Many encryption packages have something like that where it is impossible to prove the existence of a hidden container unless you already happen to know its passphrase and location. And hidden containers can hold additional hidden containers, equally impossible to find.

Re:A Good Thing?

[MasterOfMagic]

What about the bugs that would occur in your software? Writing secure software is something that's not easy and not easy to learn. Of course, there's always the problem of the assembler for your low level language might have a backdoor, and so forth. Of course, you could write everything at the machine code level, but then how are you going to enter it if your editor has a backdoor without them spying on you?

Yes, I am a pessimist. :-) At the end of the day, unless you write it yourself and you're the only one using it, you have to rely on someone else to provide resonably secure software. Just be cautious and smart and most of the time you're okay. It's just the rest of the time that you have to worry about...

Re:A Good Thing?

[Capsaicin]

>Now that this Surveillance Devices Act allows police to obtain a warrant, does that mean that information obtained unlawfully won't stand in the court?

Information obtained unlawfully never stands in court. Because the Constitution is a living document that must be updated to take into account changing technologies, however, the definition of "unlawful" must change.

Where does the Constitution (the Australian Constitutions that is), say anything about "information obtained unlawfully?!"

The correct answer to the original posters question is that this Act will have no effect on the admissibility of improperly obtained evidence, for the simple reason that evidence obtained in conformance with its provisions will not have been improperly obtained.

Note that in Australia improperly obtained evidence will, in special circumstances, be admissible. The law of evidence in the Australian Federal jurisdiction is governed by the provisions of the Evidence Act 1995 (C'th). Section 138 of this act stipulates that improperly obtained evidence "is not to be admitted unless the desirability of admitting the evidence outweighs the undesirability of admitting evidence that has been obtained in the way in which the evidence was obtained."

To find out what that rather vague statement actually means it is necessary to consult s138(3), but to summarise wildly, evidence which was obtained improperly (for which see s138(2)), should be admitted only when its probative value outweighs the impropriety with which it was obtained.

Re:A Good Thing?

[polysylabic psudonym]

I believe that in Australia, and probably everywhere else too, if a court orders you to hand over encryption keys and passwords, you are required to do so.

Of course, if you've got the warning, you may be able to lose your keys and wipe the data. Even that's not an option where big brother is permitted to remotely hack your machine without your knowledge.

Re:A Good Thing?

[polysylabic psudonym]

Oh, and "Oops I seem to have accidentally shredded/microwaved my key disk" may work too.

Re:A Good Thing?

[Nikker]

Where its illegal to 'possess any information which might be useful to a terrorist'

I always get a laugh out of these quotes. Ask youself a question, what information *would* be useful to a terrorist?

You think Osama et al are searching for the best bomb recipie? or ebay for deals on AK47's ? They have more weapons then some countries (like Canada, where I live)

But we are getting better unfortunately :(

But really what could they be looking for? Airlines that advertise "Unchecked entry and boarding" ? or maybe they are more intrested in how you break the lock to your house when your parents lock you out?

To put it mildly *any information* can be usefull to terrorists and to blanket the staement so vast is a joke. Realastically with the bankrolls they own and the people they know if there was information they needed you deleting it from a web page would not stop much.

Re:A Good Thing?

[Capsaicin]

Research my lad, research.

Physician heal thyself!

As I understand it the copyright aspects of the FTA dont mean squat to most Australias and the federal government cannot mandate legislation to the states

You've got that arse-end round. In any area where the Federal Parliament has competence, as it does under the foreign affairs power and possibly, (but probably not because of the Union Label case) under the copyright power, (see s51 plactita (xxix) and (xviii) respectively), the Commonwealth (ie Federal) law trumps the State law. The relevant constitutional provision, Section 109, reads as follows:

When a law of a State is inconsistent with a law of the Commonwealth, the latter shall prevail, and the former shall, to the extent of the inconsistency, be invalid.

Re:A Good Thing?

[splodus]

"I vaguely remember there's a country where it is illegal to obstruct surveillance by way of encryption. And you may be required to hand over all your passwords..."

You may be thinking of the UK's Regulation of Investigatory Powers Act 2000. In short you are required to hand over any passwords to encrypted information:

(a) in the interests of national security;

(b) for the purpose of preventing or detecting crime; or

(c) in the interests of the economic well-being of the United Kingdom.

(relevent section)

If you fail to provide the password, you face two years in prison. You are deemed to be in posesion of the password provided "the contrary is not proved beyond a reasonable doubt."

In short, for the first time in UK law, an act was passed in which you are guilty unless you can prove otherwise. Just how you prove that you really have forgotten a password, and aren't just pretending, is beyond me...

Re:A Good Thing?

[Mhtsos]

Oh it's worse than that. It dosen't say "useful in a terrorist activity" but just "useful to a terrorist". It dosen't even say "knowingly"!
Cop's bug picks up on the terrorist's phone "Good thing we have the same motherboard James, now I can borrow your manual. I lost mine and can't get the sound card gorking".
James goes to Jail.

Re:A Good Thing?

[Anonymous Coward]

Actually, at least a few years ago, there was an act in the UK (known as RIP, IIRC) that required people to decrypt any information on request. That's probably what the original poster was thinking of.

Re:A Good Thing?

[null-sRc]

go do a google on stenography encryption...

it's the process of hiding data inside of an image..

using a good dispersal algorithm it's impossible to extract the data without the password..

plus it's impossible to prove the image contains any encrypted data...

Re:A Good Thing?

[Anonymous Coward]

I seem to recall as a french man that the law here assumes that if you encrypted something, and are accused of something, if you don't provide the key to decrypt it, anything can be assumed to be in the file, ANYTHING.

Re:A Good Thing?

[jc42]

Good point. Maybe they've been working on solving the problems of terrorists using the maps for nefarious purposes, by making the maps so inaccurate that terrorists will end up at the wrong address.

Now, this might sound like a joke, but such things have been done.

The only real argument against it is the old advice that one shouldn't attribute to malice something that can be adequately explained by stupidity.

Re:A Good Thing?

[hesiod]

> Let's break MS into 3 little entities." And then? It was pretty much forgotten

Wasn't that ruling reversed by another judge, and not just "forgotten?"

Re:A Good Thing?

[hesiod]

> so they could add another arrest to their otherwise drab and boring existance
> All I wanted was to help a poor animal and I get subjected to a warrent search

What??? By phoning something in and giving information, you are not arrested. You were not arrested in any way in that situation, I don't know what you are trying to say, WRT that. Also, did they tell you they were searching for warrants on you? What if you were wanted in another state for luring police or animal control officers and killing them (latter, a noble cause)? They could then be ready for anything instead of just wandering into a gunfight.

Sure it's a stretch, but isn't it the government's job to assume everyone is a criminal and act accordingly?

Anyway, I agree it's stupid to ask for your info on the phone and I'd tell them to go to hell (or something much worse) if I were in that situation. The moral of the story? Never try to do good things when the police are involved, you'll certainly get put in jail (can you tell I'm no fan of authority?).

(This post has mixed serious and satirical statements: if you cannot tell the difference, try again.)

Re:A Good Thing?

[Sique]

Your compiler has not to be entirely bugfree. It has just to be good enough to compile another compiler correctly whose source code seems to be backdoor free. So then you have a compiler which should be good enough to compile a tool chain for you.

What I wanted to point out in my former post is to guarrant that your computer gets infected you have to put a backdoor in everything running on your computer. As long as every piece of code can be replaced at will, the infection chain is due to break. It is much too fragile to survive for a longer time without knowledge of the maintainers. FOSS has this great feature: Even though parts of the system may get compromised, this may not survive for long under the radar screen of the maintainers.

A similar problem occurs in the so called copy protection schemes. They work as long as every piece of code touching the data in question is cooperative. As soon as a single part breaks the rules the whole copy protection is void. This would be one of the main reasons to make breaking those schemes illegal, because the technical warranties are virtually nonexistant for any copy protection scheme to survive.

Re:A Good Thing?

[mallie_mcg]

Doh. Why do I constantly grab sticks by the wrong end >. M

Re:A Good Thing?

[Wocko]

Try steganography, not stenography.

Re:A Good Thing?

[my_haz]

As if a streetmap in london would help anyone get anywhere in london.

Re:A Good Thing?

[my_haz]

As it has always been with criminals and law enforcement/security victory goes to those who have the most resources, mostly in the form of brains, braun and attrition. To every lock there is only one key, but an indefinate number of ways to pick it.

Re:A Good Thing?

[MasterOfMagic]

You're right - the only way to make sure that you've have to make sure that something is infected is to infect everything. An infected toolchain will do just that, and so long as the code that is the backdoor is hidden in the binary and your debuggers, profilers, etc are infected to hide it, you'll never know. An even more insidious way would be to infect the kernel itself. A rogue kernel module under a Linux system would acheive this. Even if you have written your own compiler, it's possible that this kernel module could add the back door to every executable that is executed.

The point of the exercise is that there is no absolute security. No matter what steps you take to preserve your security, there is no way to be 100% secure. If you have data that you don't want on the Internet, the only way to keep it off the Internet is to not connect the computer containing that data to the Internet. Otherwise, you're just gambling with it.

Someone please tell me...

[WIAKywbfatw]

...that having software that (knowingly or unknowingly) blocks or removes this spyware isn't a crime...

Re:Someone please tell me...

[LiquidCoooled]

I think simply having Linux would make yourself (at least for now) immune.

Re:Someone please tell me...

[Anonymous Coward]

Why block or remove it? :)
Instead, run a live Linux or BSD CD with a virtual keyboard while leaving a Windows installation on the hard disk to accumulate bungware.

Re:Someone please tell me...

[penguinoid]

I think simply having Linux would make yourself (at least for now) immune.

Please keep in mind that these are the police. They are not some random script kiddy, and would focus much more strongly on your computer. It also means that they probably already got a warrent to search your house and will have physical access to your computer. And my guess is that they will be able to take control of your computer in as much time as it takes to boot (not saying how to not encourage moron kiddies). And since you think your so secure, you wouldn't even think to check.

Re:Someone please tell me...

[myowntrueself]

" I think simply having Linux would make yourself (at least for now) immune."

And given that in circumstances like this, the powers-that-be like to ban things that might make it difficult for them... like, oh I don't know, Linux for example?

Re:Someone please tell me...

[TeraCo]

I know some guys in the computer crimes squad of the NSW police, they aren't idiots, and they aren't scared of linux.

One of the parents is correct that they're likely to just get a warrant, pull your PC/laptop apart and put some kind of wacky hardware keylogger in there instead.

Re:Someone please tell me...

[pla]

Someone please tell me ... that having software that (knowingly or unknowingly) blocks or removes this spyware isn't a crime...

Well, of course it would count as a crime! Probably as simple as "tampering with evidence", but it wouldn't surprise me if they invented a special category of crime, over which we have no control, to deal with (for example) AdAware detecting and removing such software.

But... Why on Earth would you want to remove it?

Just fake it out, and you have carte blanche to commit whatever crimes you want, with the state's own "evidence" of your whereabouts to clear you at any given time...

"And how do you suppose my client committed this crime, when your own activity logs show him viewing... Um... homoerotic goat porn??? at the time of the crime?"


As an aside relating back to my first paragraph, I personally run AntiVir for precisely that reason... As a German company, they treat a US government sponsored virus (such as the FBI's Magic Lantern) the same as any other virus - Namely, they detect it, quarrantine it, and kill it. Unlike both Norton and Mcafee, which have publically stated that they will not detect any virii such as ML.

Re:Someone please tell me...

[Anonymous Coward]

To take control of mine, they would have to open the case and remove the hard drive. There is no other way to access the data.

So, a simple wax seal on the computer case would give adequate protection.

Re:Someone please tell me...

[LiquidCoooled]

If they have a warrant, and access to your computer, what the fuck are they messing around keeping it running for anyway, why haven't they just arrested you?

There is no secret piece of cross platform software available that can give 100% systeminfo without detection and be transparent to a clued up user.
There are however 100s of Windows only programs that can get so far inside the backdoor that even goatse is jealous, and STILL not be detected by a user ("Oh it was running a bit slow" they say as you nod slowly and sip your coffee whilst waiting for Adaware to finish its scan.)

btw, im a Windows user, not Linux - I merely pointed out the usual flaw in the plan.

Re:Someone please tell me...

[barfy]

Ok I am telling you... It's not a crime.

Re:Someone please tell me...

[penguinoid]

Maybe, maybe not. If you know what you are doing it will be very hard to crack your computer. However, I don't think there is much that can stand against a good hacker with physical access to your machine. Eg you have no software defence against a hardware keylogger. My point though, is that it is incredibly easy to get root on a linux box on the default install, if you have physical access.

Re:Someone please tell me...

[kfg]

Nah, simply using your own bloody spreadsheet would be "tampering with evidence."

Removing the spyware would be "obstruction of justice.

KFG

Re:Someone please tell me...

[LiquidCoooled]

I don't doubt they know what they are doing, they better HAD know, otherwise they are in the wrong place.

Their job WILL be easy however, simply by the fact that Windows users get rooted on a daily basis, and most criminals use Windows (warez version of course)

one other question, do you think its possible to keylog a tablet?

Re:Someone please tell me...

[nri]

Please keep in mind that these are the police.

yeah, they probably don't know what a computer is. Unless they have online donut stores in the area.

Re:Someone please tell me...

[Frymaster]

If they have a warrant, and access to your computer, what the fuck are they messing around keeping it running for anyway, why haven't they just arrested you?

because they're looking to get enough evidence to arrest you. all that is needed to get a warrant in most oecd countries is "probable cause". basically, the cops go to a judge and say "we have a guy who says a guy told him that person a might be a drug dealer. can we get a warrant?" and more often than not, the warrant is issued.

depending on the type of warrant, they can get a one time search and seizure, a wiretap on your phone or a passive listening device in your room. all this law in australia does is just add computer traffic to that list.

if you are concerned about your privacy and protecting it from the warrant system, you're about two hundred years late in complaining.

Re:Someone please tell me...

[Anonymous Coward]

Wouldn't linux be illegal then? It would by design (unknowingly) block the installation of said software.

Re:Someone please tell me...

[forgotten_my_nick]

So why not just create a virus like Magic lantern and use it to steal US secrets? It defies logic.

Re:Someone please tell me...

[tomjen]

Because then you will recive a free ticket to cuba.

Re:Someone please tell me...

[Anonymous Coward]

There may be no secret piece of cross-platform software, but there's plenty of cross-platform hardware, some of which is even cross-architecture.

When's the last time you checked your keyboard for hardware bugs? Do these not work on Linux?

Re:Someone please tell me...

[TheGratefulNet]

I also use antivir. I update it every day (every day). it finds updates almost every time I run it.

on a friend's pc, it found about 400 baddies. yes, that pc was full of popups/etc.

its free, they have extremely regular updates and it works. /one user's opinion

Re:Someone please tell me...

[Anonymous Coward]

Are you trying to say that they will install windows on it so that their spyware will run on it?

Re:Someone please tell me...

[LiquidCoooled]

The world is very 1984ish at present (not helped by hl2) but I don't really much give a damn. As long as I can code and surf I'm happy.

I run windows on stock hardware, and your right, how would I know?

But, giving up on the very American civil liberties is a dangerous road. The errosion of our rights has already begun, and I fear that the future holds more.

Re:Someone please tell me...

[femto]

Anyone know whether clamAV is able to detect "official" viruses?

Re:Someone please tell me...

[Anonymous Coward]

If someone has physical access there is nothing you can do. I reackon I'd notice a keylogger though..

For the moment I have bios password, no single user mode from lilo/grub, network/X11 is not started on boot, and root is a restricted user (SElinux).

(This is not out of paranoia of the police, but because a linux savvy coworker played a rather nasty practical joke. Never again....)

Re:Someone please tell me...

[Leomania]

Think about this...

AntiVir connects with some site out there to get its updates, probably using a fully-qualified hostname (i.e., not an IP address). Let's suppose "the police" are the federal authorities in this case; they have the resouces that can figure out what site is being contacted, what data is transmitted, etc. They change the DNS at the ISP to talk to their specially-prepared server that looks, acts and tastes just like AntiVir's update site. They wait for you do to an AntiVir update, at which time you get an updated set of definitions, or better yet a whole new program installed. Now the feds know your machine is "ready" to receive the spyware and it won't be detected by the now hijacked AntiVir program.

Improbable? Sure. But not impossible.

Even using Knoppix or other live CD distro doesn't protect you from site spoofing. But it sure beats trusting software/data files installed from somewhere on the Internet.

- Leo

Re:Someone please tell me...

[Nogami_Saeko]

This is why it makes a LOT of sense to install strong encryption software that's loaded BEFORE the OS, making the computer totally inaccessible if you don't know the password.

They can have all of the spyware they want, but if they can't even get the system to boot, they'll never manage to install it, and if the software also logs/displays failed or incomplete access attempts, it'll be tipping the owner off that someone was trying to tinker.

For "secure" computing, I'd be picking a laptop with a bootable encryption system (ala the now-defunct safeboot solo, drivecrypt plus pack, etc). If you were especially paranoid, you could even epoxy the case and peripheral access panels shut to make sure that nobody was going to get inside and add a hardware keylogger.

I suppose you could also sleep with it, and take it everywhere with you, but that may be overkill unless you're especially guilty ;P

On the subject of passwords, it would probably be a good idea to remember half the passphrase as something you can easily remember, and put another 10 or 12 random characters/digits on something easily destroy-able like a stick of chewing gum. If you're ever grabbed by unfriendly agents, pop the gum in your mouth, chew a few times, and all possibility of data being recovered is gone. And you have some extremely good plausible denyability for the password.

N.

Re:Someone please tell me...

[pla]

Improbable? Sure. But not impossible.

True. Possible.

However, it certainly can't hurt to start with a non-deliberately-broken AV scanner. And, although DNS spoofing may not take too much effort, AntiVir's parent company has no motivation whatsoever to cooperate by digitally signing a fake update to their program.


The biggest problem here involves trust - Once a company that we, by necessity, choose to trust to keep our computers virus-free, decides to go to the dark side and cooperate with a given government - Well, why not just have them go all the way and push out the spyware as an update?

I think you touched on that idea, but as a hack of the legit service rather than as the "legit" service itself gone bad.

Re:Someone please tell me...

[Trejkaz]

Better yet, have the spyware "record" a Fed sending illegal information to you...

Re:Someone please tell me...

[Anonymous Coward]

If they have a warrant, and access to your computer, what the fuck are they messing around keeping it running for anyway, why haven't they just arrested you?

Maybe they need a keylogger to get your passphrase to decrypt evidence. Maybe they think logging actual interaction rather than just traffic will make it easier to secure a conviction (remember people have successfully used the "it was a trojan, not me" defence). Maybe they want access to your unencrypted traffic to get leads on other criminals. Maybe... any number of different things.

Re:Someone please tell me...

[Anonymous Coward]

Every day. Fuck off.

Re:Someone please tell me...

[Caseyscrib]

We've been through times like these before with the whole Communism scare, Senator McCarthy, witchtrials, and so on. All of that has turned out fine. What I find astounding is that given history, people are still unable to distinguish a real threat of terrorism from the "hey look its a communist" crap their government spews.

Just remember, 49% of the country voted for Not Bush after an attack on US Soil, so at least we're not all idiots. It is the media's fault everything happened the way it did, but at least now I think a lot more people are aware of just how bad they are. This encourages independent thinking and research, which we desperately need more of. The media's power will crumble with the rise of independent journalism and democracy on the web.

Re:Someone please tell me...

[bobscealy]

Just fake it out, and you have carte blanche to commit whatever crimes you want, with the state's own "evidence" of your whereabouts to clear you at any given time...

That brings up another interesting angle, create a little program that regularly visits child porn sites and other content that is illegal here, saves offensive material on the users hard drive, and sends fake reports off to the police.

Re:Someone please tell me...

[eofpi]

On the subject of passwords, it would probably be a good idea to remember half the passphrase as something you can easily remember, and put another 10 or 12 random characters/digits on something easily destroy-able like a stick of chewing gum. If you're ever grabbed by unfriendly agents, pop the gum in your mouth, chew a few times, and all possibility of data being recovered is gone. And you have some extremely good plausible denyability for the password. ...and probably a really easy conviction for destruction of evidence, so that's not going to be beneficial unless you have something even more dangerous concealed behind the encryption.

Re:Someone please tell me...

[TheGratefulNet]

unless the isp that the feds are going to monkey with can do selective hoaxing, and I really doubt it, then if you switch our their dns for a fake one, it willa affect A LOT of people.

also, you (and the feds) have no idea WHAT nameserver I use! I can use any, of course. in fact, I get IP service from my main ISP but use a totally diff NS for my resolv.conf.

so there goes that idea of yours. close but no cigar.

Re:Someone please tell me...

[TeraCo]

one other question, do you think its possible to keylog a tablet?

There is no doubt in my mind whatsoever that there is some sort of 'strokelog' capability, if nothing else.

Re:Someone please tell me...

[mikiN]

One of the parents is correct that they're likely to just get a warrant, pull your PC/laptop apart and put some kind of wacky hardware keylogger in there instead.

Just use the old trick: Plug the screwholes with beewax, resin or whatever which only you know the consistency of, adding a few of your (pet's) hairs for good measure, and check it regularly.
This way, at least you know someone has tampered with your hardware.

Re:Someone please tell me...

[scribblej]

All of a sudden those stupid plexiglass cutout case mods make a lot more sense...

Re:Someone please tell me...

[jp10558]

for chewing some gum? With drivecrypt PP and windows, you can at least do the whole one os inside another. Which could let you create a pretty good alibi.

Re:Someone please tell me...

[c00kiemonster]

usualy when you underestimate the abilities of the coppers you end up in jail

Re:Someone please tell me...

[urbaer]

if you are concerned about your privacy and protecting it from the warrant system, you're about two hundred years late in complaining.

Hmmm... if the police weren't tapping the miner's phones, maybe, just maybe the eureka stockade might have been a successs and we'd (Australians) er... have a flag without the union jack?

Re:Someone please tell me...

[JustAnotherBob]

I got nervous when the armed men outside my house started to bang on my door yelling and screaming. I normally chew gum when I got nervous and inadvertently chewed my passphrase flavored gum...

Re:Someone please tell me...

[Pete]

I have a friend who works as a prosecutor (Perth, Western Australia). A while ago, he asked me if I had any thoughts re: breaking encryption - a case he was working on involved a guy with various encrypted files on his computer that they believed contained stolen credit card numbers. At the time, it would have been a "smoking gun" piece of evidence if they could get the passphrase out of him and prove what the files were.

But (surprisingly enough :)) the guy didn't want to help get himself convicted. And he was a CS grad and knew his shit with encryption, knew what he was doing well enough that it wasn't plausible to brute-force or otherwise "crack" the encryption. And of course the prosecution didn't exactly have a team of crypto-experts on call (which is one of the reasons my friend was bothering to ask me if I had any suggestions ;-)).

I suggested to him that it was a pity they already had him in custody - if they'd still had him under surveillance, I would have suggested they stick a little keylogger device in his keyboard (ie. hardware, not software - exactly what you mentioned). Then you'd get his passphrase, you'd get pretty much everything needed. Regardless of operating system, regardless of the size/shape/colour/flavour of your encryption system. Unless you normally change keyboards every day or so, that'd pretty much cover all eventualities. Well, except for the "epoxy the case and peripheral access panels shut", and especially the "sleep with it and take it everywhere with you" techniques *grin*. But I get the impression that criminals that paranoid are rare - remember that every increase in "security" has a corresponding decrease in convenience.

Anyway, he seemed to think it a good idea, saying he'd have to remember that for future cases :). I'd heard of something like that being done in a case in the US, so presumed that the hardware issue was quite solvable. Frankly, I'd think it'd be much easier and more flexible in many cases to install software keyloggers (on a suspect's computer), but the hardware method would be much more reliable and harder to detect (as well as usable for all those inconvenient non-Windows computers :-)).

Pete.

Re:Someone please tell me...

[Anonymous Coward]

A post mentioning homoerotic goat porn getting +4 Insightful.

God I love this place.

Re:Someone please tell me...

[Yartrebo]

It's happened before. All the major antivirus companies knowingly allow magic lantern in. Hasn't dented sales at all apparently.

I do wonder if WINE emulates magic lantern well?

Re:Someone please tell me...

[mr_snarf]

The plural of virus is not "virii". As cool as it sounds, the correct plural is simply "viruses". Of course, I guess if enough people use "virii", people know what you mean, but it can make you look silly.

Sorry, just had to say it :P (If you don't believe me, look up OED)

Re:Someone please tell me...

[cheekyboy]

just use old paper and pencil in coded squigly lines that no camera could see because its toooo fine a point size. .1 pixel

Or communicate UNDER WATER in the bath tub or pool, ehehehheheeheh.

Re:Someone please tell me...

[wronskyMan]

There is no doubt in my mind whatsoever that there is some sort of 'strokelog' capability, if nothing else.
Is this some new kind of pr0n system?

Re:Someone please tell me...

[cheekyboy]

ill use a tablet PC with no keyboard.

Or ill use an old sunsparc laptop.

or ill install Netbsd.

or ill use my pocketpc with a detacheable KB thats in my jacket.

Any true geek/crim will use their own mini foldable KB they can plug into the PC usb slot, perhaps also with their own bootable linux CD, you cant infect a CDROM or a portable KB using dvorak and not qwerty, muwhahahaha.

maybe I should start up a "howto" on how to hide ;_)

or ill do it all remotely and store ALL info in gmail.com, or some chineese based email service, or better yet, some russian one.

Trust me, if the LEOs are so good, they would be earning 120k in the industry, and not the govt, but then again, we know that the police get very good Super (govt retirement funds), as good as the govt politians.

Re:Someone please tell me...

[cheekyboy]

Maybe criminals should just outsource their activities to call centers in India.

Re:Someone please tell me...

[TeraCo]

Trust me, if the LEOs are so good, they would be earning 120k in the industry, and not the govt, but then again, we know that the police get very good Super (govt retirement funds), as good as the govt politians.

The NSW Computer Crime dudes are getting between 60 and 80K I believe, which is quite good. PS: I don't know what industry you are working in, but forensic sysadmin work doesn't pay 120K in Australia :P

Re:Someone please tell me...

[Anonymous Coward]

Well they would have to catch you for starters.

But lets ignore the US government and just steal other peoples secrets. Because US virus checkers (and probably OS) probably have gaping holes for whatever they want to install, the poor infected person on the other end would never know their details are being sent to another country.

Re:Someone please tell me...

[polysylabic psudonym]

"If they have a warrant, and access to your computer, what the fuck are they messing around keeping it running for anyway, why haven't they just arrested you?"

It's much easier to go to a judge and say "We believe that Mr xxxxxxx is a terrorist, he has been speaking to Mr yyyyyyyyy who is a known terrorist. We would like a warrant so we can gather enough evidence to prosecute and find Mr xxxxxxx's associates"

Re:Someone please tell me...

[m50d]

People know what you mean anyway. If you want a language where you can't use words which aren't in the dictionary, go to France.

Re:Someone please tell me...

[mr_snarf]

Meh, fair enough.

Re:Someone please tell me...

[pla]

The plural of virus is not "virii". As cool as it sounds, the correct plural is simply "viruses".

See my old Slashdot post on this topic.

But, to summarize, "virii" works as a valid English plural just as well as "viruses". However, not because it reflects some mythical Latinate form. if we want a proper Latinate plural, "virus" would take the form "vira" in the neuter third declension.

Re:Someone please tell me...

[Nogami_Saeko]

Part of a solution here might be to have a double-authentication system where you'd need to type a passphrase on the keyboard, but then also use the mouse to perform some sort of graphical authentication.

Here's an idea:

Assuming that rather than a straight password, the software used 4 different password areas in the dialog box (ala drivecrypt/truecrypt):

Type password 1, then click a specific location on an image shifted to a random x/y position on the screen, and optionally "wrapped" around the edges of the screen to make the location even more random (this type of "click the image" password protection is used on several pocketpc password applications).

Repeat for passwords 3-4. Then evaluate the passkey's hash (including mouse-click positions) to determine if it's valid or not. Without knowing the passkey, and the X-Y pixel location clicked for each part of the passkey, it wouldn't be possible to decrypt the drive.

Just the X-Y clicking alone would give you a considerable increase in security - unless they could capture images of your screen and where you're clicking, snooping mouse coordinates and clicks themselves wouldn't gain you anything.

N.

Re:Someone please tell me...

[Anonymous Coward]

maybe I should start up a "howto" on how to hide ;_)

You can start by not posting on /. using your account ;_)

Re:Someone please tell me...

[Anonymous Coward]

if you are concerned about your privacy and protecting it from the warrant system, you're about two hundred years late in complaining.

Not all of us are 230 years old, you insensitive clod!

Re:Someone please tell me...

[hesiod]

> Please keep in mind that these are the police

Yes, the same people that couldn't convict O.J.

(Yeah I know they really aren't the same people)

Re:Someone please tell me...

[neonmagic]

Quote: "There is no secret piece of cross platform software available that can give 100% systeminfo without detection and be transparent to a clued up user."

Bullshit. Ever heard of Carnivore? Carnivore can infiltrate your PC without you knowing, it can keylog, password sniff etc. If you're connected to the net, you're a target. Period. I'd put money on it that every single ISP in both USA and Australia and the UK has been quietly forced to have Carnivore installed on their servers, monitoring ANY and ALL traffic running thru the ISP, irrespective of the user account(s).

If you don't believe me try a simple trick - set up a bunch of hotmail accounts. Start sending emails to them with words such as bin laden and terrorist attack and bomb etc. Keep doing it. Make it sound real. See if the men in black come and pay you a visit, i'm sure that they will.

My proposal to beat shit like this is for every single individual with internet access to flood the net with such things. Those listening will get pretty sick and tired of doing it after a while.

Governments the world over don't give a fuck about the individuals right(s). We're sheep to them. They do what they want, when they want, how they want and where they want, and if you really think i'm paranoid think again. It's criminal that anti virus companies have not provided protection against Carnivore. I'm a paying customer and I have EVERY single right to expect protection, and they are knowingly provided users with incomplete protection. They have been economically bullied into doing what the US government tells them to do, for fear or tax reprisals and other things.

If you don't think that Microsoft has secret backdoors that the CIA et al can access at will, think again.

Dave

what's the big deal?

[SoupGuru]

The Surveillance Devices Act allows police to obtain a warrant to use software surveillance technologies

As long as they need to obtain a warrant first, I don't see the big deal.

Re:what's the big deal?

[ScooterBill]

I think that a wiretap, outside surveilance, someone following you around in an unmarked van is one thing. The unreasonableness is when you have law enforcement actually in your home via cameras, spyware, etc. The home should be off limits for this kind of thing.

Re:what's the big deal?

[savagedome]

Mod parent up up up. The government has the 'power' to do the surveillance. However, the key is obtaining the warrant which is one of the big outcry against Patriot Act.

Re:what's the big deal?

[Shadow Wrought]

Exactly. As long as due process is followed it is in the same realm as a wire tap or bug. It is when the due process bit is removed that we need to start worrying.

Re:what's the big deal?

[fireduck]

but aren't law enforcement agencies already allowed to go into your home and install surveillance devices (e.g., microphones) if a warrant has been granted? this just extends that power to your computer.

Re:what's the big deal?

[JudasBlue]

Okay, just to play the devil's advocate, you do anything you want to in your home, that becomes off limits to surveilance? I don't really see that working out. Especially when you are talking about RICO and conspiracy stuff. Just hold all meetings in your home, and you are good to go.

Nah, I don't see that being all that good an idea, if you posit that there is a purpose to having surveilance under warrant in the first place, then saying that you have known sanctuary from it in your home doesn't seem very logical to me.

Re:what's the big deal?

[Telastyn]

I was going to post the same thing, until I realised that there's a subtle distinction. Phone tap warrants [to my knowledge] don't actually do anything to the alledged criminal's property. They place the tap at the CO, and listen in. Once the info leaves the ownership of the alledged criminal it's fair game [like their trash].

Actual property search warrants [to my knowledge] require the alledged criminal to be issued the warrant, and present for the search. The info in the computer though [assuming no internet connection] stays in the computer. Placing a keylogger on the machine without informing the owner seems to be a special circumstance to get around age old search warrant law.

It'd be much better if it limited the spying to internet connections.

[disclaimer: I am not austrailian, and I am not a lawyer, some assumptions might be wrong, and render the arguement moot.]

Re:what's the big deal?

[cronius]

This is very different from a wiretap. Would it be OK to have surveillance cameras secretly installed in peoples houses too, even with a warrant?

Re:what's the big deal?

[dabraun]

Wiretaps used to be installed in or close to the actual home being tapped. It is only because the phone companies (were required to) make it easy to tap at the CO that they don't need to do this anymore.

They can still get warrants to tap homes for actual sound within the home. And they don't need to tell the person being tapped - they just need the appropriate warrant.

Re:what's the big deal?

[penguinoid]

I like how you said when rather than if. I wish that there were something that would stop the government from increasing its power over us, other than the fact that it might piss people off. Its a rather scary trend and I don't see it stopping any time soon, while people keep getting more comfortable with it.

Re:what's the big deal?

[Lord Kano]

Exactly. It doesn't bother me if the police must obtain a warrant first.

This at least requires a minimum about of oversight by an authority higher than the cop who has it out for you.

LK

Re:what's the big deal?

[razmaspaz]

I think this is OK as long as the warrant restricts them from physically entering the home to install such software*. A warrant that allows entry to the home is in my opinion a grey area. Of course there are warants issued to place recording devices in homes, so....

*I would say this is a big argument for criminals to use OS software as the security through obscurity becomes increasingly valuable, imageine the look on the WIndows Technician's face when he sees a CLI login screen. WTF, how do I install spyware on THIS!

Re:what's the big deal?

[adjwilli]

Over 30,000 federal warrants were request last year. Only 32 were denied.

Re:what's the big deal?

[ViolentGreen]

They can still get warrants to tap homes for actual sound within the home. And they don't need to tell the person being tapped - they just need the appropriate warrant

True. Didn't you see that episode of The Sopranos where they bugged the lamp in the basement? TV never lies. Then again, "It's not TV, it's HBO."

Re:what's the big deal?

[bombadillo]

It is understandable as long as a warrant is needed. My concern would be about the Patriot Act in the USA. A warrant is no longer required for many things. I wonder how this would pan out over here.

Re:what's the big deal?

[MCraigW]

Well... yes. They do that now. Remember the nice little video of Marion Barry and the hooker smoking crack? That was in a hotel room, but it's the same principle. And then the voters of Washington D.C. re-elected the upstanding Democrat.

http://www.rotten.com/library/bio/usa/marion-barry /

Re:what's the big deal?

[pete-classic]

They are commonly known as "sneak and peek" warrants. They are properly known as "delayed notification" warrants.

They are a great tool in theory. They are very hard to not abuse in practice.

I'm against governmental authority to do sneak and peeks.

-Peter

Re:what's the big deal?

[dorsey]

The only thing you can reasonably conclude from that is that cops aren't in the habit of asking for warrants they know they won't get.

Come back when you have info about how many were later found to have been issued improperly.

Re:what's the big deal?

[Anonymous Coward]

by using a boot disc to install a keylogger that operates under the OS (the only problems would storage and transmission of the data since the OS usually does this).

Re:what's the big deal?

[Anonymous Coward]

The Surveillance Devices Act allows police to obtain a warrant to use software surveillance technologies
As long as they need to obtain a warrant first, I don't see the big deal.

They don't have to tell you theyre getting a warrent though.

Re:what's the big deal?

[Anonymous Coward]

You mean like the patriot act?

Re:what's the big deal?

[iminplaya]

Maybe because the warrant, like the law itself, can be(and has been) used as a political tool. To me a warrant is a violation for the above reasons and more. We should never allow those responsible for making and upholding the law to break the law. In fact they should suffer double the normal penalty. We sure should never let them make laws that grants them any more rights than you or I have. All this crap about terrorism and kiddie porm is a smokescreen. Don't ever expect me to respect any law that grants special privileges to a particular individual or group.

Re:what's the big deal?

[Anonymous Coward]

In 2000, 0.004% of applications for warrants for interception of telecommunications services in Australia were refused. Doesn't sound like there's a lot of scrutiny happening here...

Source- Attorney General's Department "Telecommunications (Interception) Act 1979 Report for the year ending 30 June 2000" (www.ag.gov.au)

Re:what's the big deal?

[IO ERROR]

I wish that there were something that would stop the government from increasing its power over us, other than the fact that it might piss people off. Its a rather scary trend and I don't see it stopping any time soon, while people keep getting more comfortable with it.

In the U.S. that's supposed to be We the People, all our votes and all our guns. Most people, however, have been snowed by U.S. government propaganda aimed at its own citizens. "This will protect you from terrorists." Bullshit. But most people eat it up.

The tree of liberty is withering...

Re:what's the big deal?

[Kanasta]

1 How hard is it to get a warrant?
2 How often will they FIRST tap you, THEN if they find anything they'll get a warrant so they can use the evidence?

Re:what's the big deal?

[Anonymous Coward]

That's 30000+ reported under the legislative requirements, which do NOT include intelligence agencies. They are the main users of intercepts, so you can double that figure.

And that is a lot in such a small market.

The agencies use telecommunictions intercepts a lot because it's cheap. It cost them (a few months ago) a few hundred dollars plus GST for the telco to put the intercept in place, and ongoing traffic charges. Under the legislation, the telco neither profits from nor incurs a loss from assisting agencies, so it's pretty cheap to run. And a hell of a lot cheaper than having a couple of cops following someone around.

Re: what's the big deal?

[d3an0]

Whilst this has raised many concerns about privacy and civil liberties etc. This legislation is a case of ammending dated legislation to bring it into line with modern forms of communictaion. Prior to this there were a number of grey areas that were not clearly defined by applying laws relating to traditional public switched telephone networks which was governed by the Telecommunications Interception Act. Current communications such as E-mail, Instant Messaging and SMS etc weren't clearly defined as they are in the new legislation. Obtaining warrant for this legislation I believe requires convincing a judge that you have reasonable grounds to suspect the commission of an offence. Now when it comes to swearing out a warrant and using the powers contained in them in this case they are scrutinized heavily by the juduciary and not taken lightly. If people aren't doing the wrong thing then there will be insufficient grounds to obtain a warrant. If data is used that is found to be seized without lawful justification then it will not stand up in court. These laws aren't about Big Brother monitoring the activities of everyday people they are giving Law enforcement the tools prosecute genuine criminals.

Re:what's the big deal?

[Lee Darrow]

The big problem is that if the cops can do it, then pretty soon that software will be in the hands of people who make their livings off of US making OUR livings via identity theft. It also opens up a whole can of worms with regards to the preservation of evidence and the use of pre-emptive police actions against a possible offender who s only in the planning stages or who is running a game - ask Steve Jackson Games about THAT one! You also have, with such a product, the next logical extension, which is the ability to take over your computer, possibly in a transparent mode to the user, and PLANT incriminating materials on there should the individual in question be a thron in the side of the Powers_That-Be. Nope! Not good. Not good at all. Hope this clarifies some of the concerns those of us who still believe in the "innocent until proven guilty" laws. Lee Darrow, C.H. http://www.leedarrow.com

Re:what's the big deal?

[Anonymous Coward]

you might like:
http://www.signs-of-the-times.org/

Re:what's the big deal?

[Anonymous Coward]

I recall back in the day ASIO doing some work for the National Crime Authority, using DSD staff and equipment. Physical access to either computer was not possible. (maybe I just heard all this from a conspiracy theorist... :-)

Anyway.
V.90 modems are a tad more complex than the shhhhhh noise would have us believe. Trellis Coded modulation, echo cancellation, and all that type of crap.

It was done by recording both ends of the link, then feeding the resulting streams through a couple of V.90 modems of their own. (Not sure if they were standard or modified in some way)

That was back the latish 90's somewhere.

Many of the laws regarding the intercept of domestic or offshore communications are also available to joe-average public. You want to set up a sigint/comint station? Go right ahead - it'll cost somewhere in the region of 80 million dollars (Australian) for a reasonable spread. All legal. Don't try to buy just one half of any communications system though, you'll be earmarked as a spy instantly, though this rule applies predominantly to TDMA systems. (Unless you can scrounge yours from a telstra dumpster :-)

I know you read this back at HQ....

So the have to get a warrant

[Neil Blender]

How is this any different from a legally obtained wiretap?

Re:So the have to get a warrant

[Ironsides]

A wiretap on your net connection won't let them see unencrypted IM or Email conversations you have. Or let them get access to files on your PC. Think "Trojan+Keyloger+FTP Server" when they say spyware. (FTP server is for access to files).

Re:So the have to get a warrant

[Neil Blender]

A wiretap on your net connection won't let them see unencrypted IM or Email conversations you have.

Let me add two words to my post: In principal, how is this any different from a legally obtained wiretap?

Re:So the have to get a warrant

[SlamMan]

Hey thats cheating! You also added a comma.

Re:So the have to get a warrant

[X0563511]

And what is to stop you from noticing strange new incomming connections, terminating them, and locking your system down? They would have to do some serious modifications (that i would probably notice) to prevent me from noticing that there is an FTP server on my machine.

The simple fact that i do a full TCP/UDP (full connect, not syn) scan on my machine every now and then (Ports 0-65535, with banner grabbing) would show it to me.

Re:So the have to get a warrant

[99BottlesOfBeerInMyF]

How is this any different from a legally obtained wiretap?

It is different mostly in that poorly written wiretaps are unlikely to crash your phone, and closed source wiretaps, purchased from some shady company/guy, are less likely to send a feed to some third party. I hope there is a clause that will make the police responsible for any damage they cause, and any property or trade secrets that are destroyed as a result of said software.

Re:So the have to get a warrant

[Alien54]

I hope there is a clause that will make the police responsible for any damage they cause, and any property or trade secrets that are destroyed as a result of said software.

(snort)

you can't be serious, can you? They never take responsibility. It's your own darn fault for looking suspicious in the first place.

Nice

[beavis88]

Let's hope AdAware picks up those signatures real quick! :)

Re:Nice

[amrust]

I just hope they don't get Ad-Aware and Spybot "on board with the program", to where they won't detect them.

Re:Nice

[jcern]

Well, I'd think that if this passed here in America, the law would attach the death penalty (or something equally unappropriate) to any software company that would allow users to cicumvent this. Hopefully, Australia is not that backwards yet.

Re:Nice

[StillNeedMoreCoffee]

In the US all they have to do is copyright the spyware's protection mechanisms and then under the DMCA it would be illegal to circumvent that spyware.

Re:Nice

[KillerCow]

I just hope they don't get Ad-Aware and Spybot "on board with the program", to where they won't detect them.

Several years ago, there was talk about spy agencies using viruses to gather information from computers. Some reporter asked Symantec if they would exempt these viruses from U.S. agencies from being detected by their software. Symantec said that they wouldn't. They said that if they allowed U.S. viruses to be immune, then they would likely have to do the same for every other contry that they had an office in, which meant that more than one nation's would be immune, so their customers in any one nation wouldn't like it.

Re:Nice

[Anonymous Coward]

IANAL, but I have a hard time believing that. If that were the case, Gator could copyright their mechanisms for gaining a death-grip on your OS, then sue you when you try to remove their crap.

Re:Nice

[lifeblender]

But if they (the FBI or equivalent) obtained a copyright for said mechanisms, then it would be publicly viewable, giving away the very information they wish to conceal.

Re:Nice

[thegrassyknowl]

Probably already been said, but just because they copyright their crap doesn't mean you _have_ to have it installed. It's like the RIAA coming up to me and FORCING me to take a pile of their shit CDs and listen to them. It's my computer and I'm allowed to uninstall any damn software that's on it; no matter who installed it.

Circumventing the protection involved breaking encryption, illegal copying and breaking measures designed to stop you using the software without paying it. It can not possibly extent to removing a piece of software that has been installed on your computer (possibly illegally).

How does that stand legally? Just because they can get a warrant to install this software doesn't make it legal? They are by definition changing my property by installing it. It is a very rare case when it is legal for the police to forcefully enter a property. The same should go for computers.

What if they circumvent my firewall and special protection measures? Are they then breaking the law?

Them forcefully installing software may overwrite a file that I accidently just deleted and make it impossible to recover. If they do it while I have a disk error they could possibly trash even more.

What if their software isn't compatible with my system (for whatever reason) and it crashes (or worse causes it to trash all my data)?

If I lose valuable data as a result of their actions then am I entitled to compensation for the loss of $10bn worth of income because my new blockbuster invention that was going to change the world went missing when they broke my computer?

This isn't as simple as simply coming into your house and snooping about. It has more implications because computers are complex, tempremental things. If they seized the computer, did a bitwise copy of the hard disk and returned it then I can't claim they hosed my data.

Remind me to sue the govt if they ever install this in my computer. I'm sure I had some files that went missing when they did it ;)

This is fucked. Fucked I tell you. Warrant or no there is too much they can do wrong and easily get away with. Let them snoop, but let them do it non-invasively. If they want the information let them knock on my door and bloody well sieze it like they used to.

Re:Nice

[martinX]

Wouldn't they have to state that in the EULA when you install the FBI's spyware? Oh, wait...

Re:Nice

[Anonymous Coward]

No, that's not true.

You'd have to agree for them to install it, after they present to you a warrant.

Otherwise it's unlawful invasion.

Re:Nice

[StillNeedMoreCoffee]

I think you miss some fine points here.

"How does that stand legally? Just because they can get a warrant to install this software doesn't make it legal? They are by definition changing my property by installing it. It is a very rare case when it is legal for the police to forcefully enter a property. The same should go for computers."

if they follow the law and get a warrent then thier intrusion is by its very nature Legal. If you wanted to sue them for damages possibly, but not for intrusuion. The law and the warrant makes it legal.

Re:Nice

[thegrassyknowl]

If the police have to alter my property in order to enter it then I am entitled to compensation. A warrant generally says they are allowed to enter the property, but if they have to smash down the door they'd better have a damned good reason (ie, not just suspect that I might have downloaded a couple of copyrighted movies one time).

The same goes with my computer though. By installing software on it they are performing a modification to my property. The very act of modifying my property can be used against them as far as the fact that if they can add a spybot to my computer they have the ability to plant evidence on my computer fraudulently. They have the ability to trash my system too.

As I said, if they change my property (kick in the door) by entering on suspicion of something that I didn't do then they have broken the law.

This is one of those knee-jerk reactions of the gumbiment in response to the "terrorist" threat. There is no major threat.

Anywho. It still makes me angry.

Re:Nice

[StillNeedMoreCoffee]

Angry here as well, but consider the trend. Copywright violations are now up to what "Under federal law, $750-$150,000 may be sought for each illegally shared item." so the penalty for each infringement of copyright is pretty sever (punishment fit the crime???).

If you look at legistation that allows a portion of the money's recovered from Drug Busts or busting Drug Dealers (confiscation and sale of properties).
Then all that would have to happen if the industry wanted to get the law enforcement on their side is give them a cut of the profits. I think this is a very bad idea, even in the drug case, because money strapped governments (of which there are more and more, and the conservative republican mood is get someone else to pay for it not me) have a tendency to up the arrests to fill in sagging budgets. You see it in many small towns when the end of month comes by and the Speeding Ticket quota has not been reached, the traps go up in ernest. There should never be direct economic benifit to arrest someone by the arresting officer. This is called conflict of interest. But as we see, that can and has been legistated as OK.

So if you can claim a value for the data on your personal computer, subtract from that number $150,000 for each copyrighted song, file or program on your hard drive and you will see. Under those circumstances you loose and loose big.

So the new terroism if you look at the DMCA and the directions of the laws is IP terroism.

Re:Nice

[thegrassyknowl]

You shouldn't have to consider the trend when the trend is blatantly wrong. The recording and movie industry is as bad as the oil industry. They are driven by dodgy contracts and extreme pressure on both artists and customers. They put a lot of undue force on and then restrict what the artist can do with their own work anyway; in most cases the recording company takes ownership of the work, so this "depriving the artists" crap doesn't cut it because the artist doesn't get squat.

Legislation that sells off the assets of offenders (especially in the drug case) is OK if the money is put to good use and not just squandered. There is similar legislation that gives the police powers in Aus to sell off your assets to pay any overdue fines. They still need to give you time to pay and an appropriate number of late notices but AFIK they don't need to take you to court to do it.

As for subtracting $150,000 for each copyrighted song on my computer... if they are trying to claim that the songs that I wrote and recorded are their property they will promptly be thrown out of court. Those songs are copyrighted by default, but I am allowed to do what I feel with them. I don't collect illegal music (well I download the occasional song to see if I want to buy the CDs) but if I don't like it it's deleted and if I do like it I go out and buy the CD.

Nobody is losing out as a result of my actions... if I'm not allowed to preview then I'll just stop buying CDs and listen to the radio; then they will lose out on my CD sale.

I will just put a massive value on the data on my computer. Nobody can prove otherwise; my data was a project that would put Microsoft out of business and make me $100 billion dollars and they destroyed it!

The new terrorism is not anybody bombs. It's the bloody recording industry - they inspire fear and hatred in the general public with their greed, constant stream of formula-generated shit and then they sue you when you don't want to pay their (illegally fixed) price for the shit they spew out.

Only in ...

[Anonymous Coward]

America .... Ooops

Whats are the Australians trying to do Give America ideas ?

Quick someone stop them

Re:Only in ...

[Anonymous Crowhead]

Whats are the Australians trying to do Give America ideas?

No, just preparing their application to become the 51st state.

Re:Only in ...

[Anonymous Coward]

They're too late to be the 51'st. Maybe 53rd or 54th. They have to get in line behind a couple of Canadian provinces.

Re:Only in ...

[CK2004PA]

Giving us ideas? We gave it to them. See Carnivore.

Re:Only in ...

[khromatikos]

But I thought the 51st state was the maple leaf state.

adaware illegal???

[musichead]

What dire portent does this entail for the use of apps such as adaware, or other programs intended to rid a user's computer of software that snuck into there install base?

Re:adaware illegal???

[Anonymous Coward]

You need to understand how anti-spyware software works. It doesn't automagically shield you from malware, nor does it inherently know what's a good program and what's a bad program.

The reason you have to frequently update is because the human programmers do the grunt work of identifying malware and how to remove it, not the software itself. So all it takes is the federal government telling Adaware and whoever else to not mess with their snoopware and you will be completely unprotected.

Just when

[DrMyke]

I may be a little off topic on this, wont Anti-Spyware like Giant and Adaware find this? and if properly configured wont they also see them being installed??

Re:Just when

[sagenumen]

Surely, any of the commercial spyware-sniffing programs will have pressure from the governments to overlook this government-sponsored spyware. Being a commercial endeavor, they are more than likely to succumb.

Great...

[cdrudge]

I'm sure this power won't ever get abused.

Re:Great...

[KingPunk]

even bank personal identification numbers and passwords. ..*ahem*, my thoughts exactly.
how many CLEAN cops are there, who wouldn't be tempted,
espically if the guy is a big drug lord or something,
with billions in the bank, and it'd all be justified as: "hes a bad guy, so im not hurting somebody innoncent"
..i call bullshit.

what? they don't wanna have to work to wiretap somebody anymore?
they think they can just drop an executeable file on a remote box,
and it works automagically?
*laughs*
... i'd like to see them get around my pf rules,
on multiple boxen, and even if they do, lets see them try to lay an exploit on my OpenBSD server,
or some of my Secure FreeBSD and Gentoo Linux boxes..
*hides his windows xp pro box, so they cant do anything to the poor thing*

anyways. times like this is why im glad im an american!
..yes, even as much as i'd kill to have an authentic "AUSSIE" accent.
(women love the accent, it melts them.) ;)
--KingPunk

Re:Great...

[Thud457]

• You bleeding heart liberal.
• If you have nothing to hide, you have nothing to fear.
• Our law enforcement agents aren't fallible and human, they're angelic supermen invulnerable to temptation.
• This will only be used against BAD PEOPLE (You know they're bad because we told you they are).
• Why do you hate Amer^H^H^H Austrailia?!!!

Re:Great...

[Anonymous Coward]

The frequent line breaks and liberal use of commas make this post sound like a beautiful piece of poetry. Until you read the content.

Re:Great...

[rhombic]

You forgot "Think of the children!"

Re:Great...

[KingPunk]

lol, thanks for making me laugh. i needed that.
but in reality, im not bleeding heart liberal,
just less-believe-my-govt-because-they-tell-me-to.
thats not ever how i've been.
but its ok for people to nail me to the wall over the net,
the whole fact is, people have rights, even the bad guys.
what happened to the day when the bad guy actually had a chance to live happily ever after too? ;x

Re:Great...

[InfiniteWisdom]

You really need to learn about punctuation.

I can just see it now.

[Anonymous Coward]

Look (insert officer's name here), he just typed in the password to that pron site he is always visiting; now we can get in free too.

Re:I can just see it now.

[PitaBred]

And if that's a child pr0n site, they have a whole new set of evidence.

Wonder...

[ackthpt]

I wonder if they'll find digital finger prints of 10 year old boys and Michael Jackson on pr0n sites...

Your Honor....

[Moonlapse]

We caught the defendant logging into marsupialsgonewild.com.....

Of course...

[doi]

...this means we'll have to install spyware on the cop's computers to make sure they're properly complying with the law.

Linux switch...

[PincheGab]

Now this more that anything else will persuade many "normal" (ie, non-tech nerds)) people to switch to Linux...

One cannot trust a closed-source anti-government_spyware program working an a closed-source O/S, but the same perogram implemented as open source running on an open-source O/S? Yeah, much better.

Re:Linux switch...

[Anonymous Coward]

Now this more that anything else will persuade many "normal" (ie, non-tech nerds)) people to switch to Linux...

...and, as all good things seem to end, will probably persuade many law-makers to try and make Linux illegal. "Won't somebody think of the children!"

Re:Linux switch...

[Anonymous Coward]

Yeah because you know it is impossible to install spyware on a linux system. Rootkits anyone? Guess what they are going to have physical access to the computer so no matter what os your using they can still monitor it.

Re:Linux switch...

[Chyeld]

I realize people like to think of the 'fuzz' as a bunch of coffee swilling doughnut eating imbeciles. However do you really think it would be THAT hard for a properly trained professional to 'root' a liniux box in a way that you'd never notice?

C'mon. Whatever OS you run, unless they are sending the uni's over with the equivalent of an AOL CD, they'll be able to get their hooks into.

Re:Linux switch...

[vinyl1]

This is an interesting, and difficult question.

It would depend on whether the police try to install remotely, over the Internet, or sneak into your house and install directly. In either case, there are difficulties.

Remotely, a simple software firewall or NAT can block all listeners. Of course, they can try to trick you with an email or a web page, but whether this will work depends on your email client/web browser and security settings.

If they sneak into your house, they might have trouble getting into your computer if you use strong Administrator/root passwords. Booting with DOS won't really help the NTFS, while single-user mode in Linux might prove useful. But there's always the tripwire solution.

Many security packages also have custom keyboard drivers, so you don't go through the regular one when you type in your password.

I won't even go into fancy stuff like DriveCrypt PowerPack, which allows you to encrypt your 'C' drive and requires a passphrase to boot up.

The FBI adopted the hardware solution, with a little extra device on you keyboard cable. However, many criminals are now keeping their keyboards in a safe.

has reported greater than that

[Anonymous Coward]

Nice busted link, jerks. You do realize that you're called 'editors' for a reason, right?

Re:has reported greater than that

[Anonymous Coward]

You do realize that you're called 'editors' for a reason, right?

Hey, now. W is called 'president', but that doesn't make him competent either.

uh...

[2MuchC0ffeeMan]

How long until this is padded on to the next patriot act?

I can just see Bush drooling over this.

Re:uh...

[Anonymous Coward]

Ever heard of Magic Lantern?

http://www.msnbc.com/news/660096.asp?0na=x21017M 32 &cp1=1

Re:uh...

[Anonymous Coward]

The US Government can already do this... and have.

I remember reading; they captured the PGP passwords for some "organized crime" figure several years ago.

Thoughts On Law Spyware

[teiresias]

Of course the next question is (besides the privacy concerns) is using programs such as AdAware and Spybot S&D to remove said Federal Spyware illegal. My guess would be yes but I also suppose that the people who would be getting these "taps" on their computers won't care much about the legal reprocussions of removing them.

I also, wonder what kind of stance the Australian Law Enforcement will take towards these companies. Will they provide them with information to avoid their spyware (I doubt it)?

I'm actually more suprised this isn't a bigger issue or perhaps it's just the first legal documentation of this while it's a practice long used?

Re:Thoughts On Law Spyware

[penguinoid]

is using programs such as AdAware and Spybot S&D to remove said Federal Spyware illegal.

Simple answer: no. That should be rather obvious with a little thought. Look at it this way, if you did not know that the spyware installed was Government Approved(TM) spyware, you would not know that you are going against them. But, if you do know your computer has govm't spyware, then their spyware is useless because you would just not use that computer to do anything suspicious.

What might become illegal is for anti-spyware companies to remove government spyware. That is not likely either, since once a hax0r gets ahold of said spyware, they would be immune from anti-spyware.

Will it be illegal to remove the spyware then?

[hsmith]

would you be breaking laws? where is this taking us? what does the spyware track?

Re:Will it be illegal to remove the spyware then?

[Kevitt]

Does it really matter?

No matter what it would track, or where it takes us, or whether legal to block/remove, it's still a bad idea. Actually, it's just a stupid idea.

Re:Will it be illegal to remove the spyware then?

[LiquidCoooled]

The spyware is gonna be just like all the other crap that windows computers become infested with.
Also, its gonna hold all your web form information in a handy Police branded folder, it means its doubly secure from nasty hackers ;)

If your running a Mac, or Linux I think your immune anyway, but why worry about removal, don't you validate EVERYTHING installed on your system ;)

I don't think they would ever come knocking at your door with a cd rom, so its gotta come in via one of the "normal" channels, and that means them throwing packets at a router, or some security vuln in a used email software.
I doubt they would package it with any mainstream software (privacy lawsuits from other countries), and the only other way is seripticious direct access to the machine, either by a co-worker, or family member/friend.
It sounds like an awful lot of trouble to get information thats mainly accessible from ISP monitoring anyway (server connection logs, mail headers etc, build up the relationship tree).

One side point, can keyboard sniffers "read" stuff entered from an onscreen keyboard? can they "read" hand written tablet keystrokes, or the password info inside a smart card?

How would they go after a hacker with a Tablet?

Couldn't this be used to prosecute?

[mobiux]

Say someone who wrote a virus or trojan to capture keystrokes.
Or even spyware for that matter.

Like wiretapping without a court order?

Australia has never been the same...

[Anonymous Coward]

...since the Nazis took over.

Whatever

[the_mad_poster]

Yea, OK. Because as the software companies have learned from their massively successful bout with game pirates (assuming you use "successful" to mean "it wasn't warezed before it even hit the bloody store shelf") you can effectively use a person's PC against them.

Whatever. Looks to me like the computer geek is just going to become a staple of the successful organized crime family in Kangaroo-land, that's all. You cannot put a skilled person in front of a computer and not have them figure out how to break your stupid protections and spyware and whatever else you want to try and pull over on them. If it's on my computer, and I have a reason to go looking for it, I'll find it, and I'll break it. Guaranteed. You cannot hide things from someone on their own computer.

Yet another technology that will have absolutely no effect on the big time criminals and will waste money catching the little guys that weren't really capable of getting away in the first place. In fact, I'm now taking bets on how long until someone figures out how to sniff out the signature and disable it.

Re:Whatever

[neoform]

i wonder if it's illegal to uninstall/break it if it was installed by police.. ?

Re:Whatever

[Realistic_Dragon]

Looks to me like the computer geek is just going to become a staple of the successful organized crime family in Kangaroo-land

On the plus side there are now a lot of extra interesting and challenging jobs available for any unemployed slashdotters and organised crime is one thing that's totally safe from outsourcing!

Re:Whatever

[dbitch]

Mod parent up. Because if they want to install a keylogger, then it's very easy to get around (notice I didn't say circumvent, it may very well be illegal in the US to go around a "lawfully placed anti-circumvention device to record your circumventions") - just install something else (pick your distro of choice) that their software doesn't work on. Easy enough. Watch me elude their keylogging efforts simply by making a SSH keypair and using a *nix/*bsd variant.

Re:Whatever

[ajs]

"If it's on my computer, and I have a reason to go looking for it, I'll find it, and I'll break it. Guaranteed. You cannot hide things from someone on their own computer."

I disagree. Bad intrusion software is easy to detect. Good intrusion software is difficult to detect. Top notch intrusion software can exist for years under the nose of skilled people who are looking for it.

Also, what makes you think that the good stuff will be software? Ever wonder what all of that firmware on your video card does? If it just detected certain kinds trigger conditions (perhaps on the bus from certain kinds of ethernet packets being latched off of the network card) and responded by taking a screenshot and saving it into some unused header space in outgoing HTTP requests (hard to grab and re-write from the bus, but I'll bet you could do it)... how would you know? No disk activity. No increase in network usage. No software running on the main CPU...

Better yet, just put it in the network card... that market is totally cut-throat, so I'll bet that anyone who offered a network card manufacturer a large sale or two in exchange for some extra firmware... well...

"Yet another technology that will have absolutely no effect on the big time criminals and will waste money catching the little guys that weren't really capable of getting away in the first place."

Well, it will enforce a kind of evolution, right? The guys who manage (however they do it) to survive this kind of attack will win. That might not be the biggest fish.

Re:Whatever

[Rude Turnip]

If you're really a badass criminal (and not some dork in his parents' basement complaining about some far-flung govt. conspiracy out to get him), you'll just keep things as they are running if you discover the tap, and get a new computer to do your business with.

Re:Whatever

[barfy]

Not all people are computer geeks, and high up criminals I am damn sure are NOT letting their computer geek friends look at thier computers. And if they *are* they are the ones that have been most likely turned by the authorites and installed the monitoring software on the computer.

I would fully disagree with the phrase *ABSOLUTELY* because that phrase is almost *ALWAYS* wrong.

Fact is big time criminals use either off the shelf or easily obtained software for ill-will. That software is easier to be monitored on the machine than any other fashion, and some percentage of those monitored, and probably some large percentage will have damning material monitored that will be used against them.

And the rest of you will be reinstalling your OS every day, because you have some paranoid belief that the Goverment has any reason whatsoever to care about you at all...

Re:Whatever

[dr_dank]

Watch me elude their keylogging efforts simply by making a SSH keypair and using a *nix/*bsd variant.

So they'll just install a hardware logger. OS and ssh keys mean nothing if your own keystrokes are being captured right at the source.

Re:Whatever

[the_maddman]

Also, what makes you think that the good stuff will be software? Ever wonder what all of that firmware on your video card does? If it just detected certain kinds trigger conditions (perhaps on the bus from certain kinds of ethernet packets being latched off of the network card) and responded by taking a screenshot and saving it into some unused header space in outgoing HTTP requests (hard to grab and re-write from the bus, but I'll bet you could do it)... how would you know? No disk activity. No increase in network usage. No software running on the main CPU...

Well since the firmware on your video card is limited to a certain size, and is patched into the system board BIOS, with any modern OS the bios is completely bypassed. And if you have an AGP video card, there's no way it can even see PCI bus traffic without the CPU being involved. I'm not even going to go into the whole saving screen shots into outgoing HTTP headers. I don't think our law enforcement professionals would want to be chasing down the logs of web servers just hoping that little bits of data were saved.

If they're using any sort of hardware logging, it'll be a keylogger, or maybe something like the innards of a ethernet KVM.

If this is anything like what I see in Government, some scumbag will convince them to buy some miracle spyware product for an outrageous price, and it'll be easily removed by HiJack This! and turn into a laughing stock. Then they'll go back to keyloggers and just seizing the computers and running InCase on them.

Re:Whatever

[corbettw]

On the plus side there are now a lot of extra interesting and challenging jobs available for any unemployed slashdotters and organised crime is one thing that's totally safe from outsourcing!

In Australia, first you get root, then you get the power, then you get the women!

Re:Whatever

[ajs]

"Well since the firmware on your video card is limited to a certain size, and is patched into the system board BIOS, with any modern OS the bios is completely bypassed. And if you have an AGP video card, there's no way it can even see PCI bus traffic without the CPU being involved."

Certainly bridging the AGP/PCI gap would be difficult (not impossible, and would certainly be more detectable), but a) not everyone uses AGP b) next generation systems won't have this unfortunate distinction.

"I'm not even going to go into the whole saving screen shots into outgoing HTTP headers."

I was suggesting IP headers of HTTP traffic, actually.

"I don't think our law enforcement professionals would want to be chasing down the logs of web servers just hoping that little bits of data were saved."

Why would you care about the end-point servers? You just tap in at the ISP. In the US ISPs are required to provide facilities to allow law enforcement to trap traffic, given a warrant. I'm sure the same is true for many other countries. The catch is, forcing the data out to the ISP in the clear.

"If they're using any sort of hardware logging, it'll be a keylogger, or maybe something like the innards of a ethernet KVM."

Which is essentially what I described, only more carefully hidden.

"If this is anything like what I see in Government, some scumbag will convince them to buy some miracle spyware product for an outrageous price, and it'll be easily removed by HiJack This! and turn into a laughing stock."

Not to join the tin-foil hat crowd, but simple logic suggests that your observation of incompetence does not preclude competent tools existing at the same time.

Tempest has been around for ages, as have hardware keyloggers and video transmitters (not Ethernet KVM). These techniques have been used successfuly against criminal and government organizations of all sizes.

Pure software approaches exist as well, including hijacking software update sessions (this requires vendor cooperation in most cases) including OS and virus detection, riding on the back of detectable malware as a smokescreen, etc.

Re:Whatever

[Kaa]

...and responded by taking a screenshot and saving it into some unused header space in outgoing HTTP requests (hard to grab and re-write from the bus, but I'll bet you could do it)... how would you know? No disk activity. No increase in network usage. No software running on the main CPU... Better yet, just put it in the network card...

The answer's trivial: sniff your own traffic.

Hopefully the net traffic from your machine goes through some kind of a firewall (right? right..?) which can log every single bit. Finding suspicious stuff (e.g. something stuffed into unused header space) shouldn't be hard at all.

Granted, you may have problems figuring out which code on your machine does it, but detection of the spyware's traffic is quite straightforward.

Re:Whatever

[dbitch]

What's easier, sending a trojan out on the wire to unpatched windows boxes (or, maybe, they've got a special packet that will make the windows box install it automagically) or installing a hardware keylogger pn my *nix box? Besides, if I'm worth spending money for a hardware keylogger, I have bigger problems...

Re:Whatever

[gatekeep]

Sniffing your own traffic to look for unknown data of an unknown format in unknown packets at unknown intervals is hardly trivial.

If they have a stream of data going to server.autralianequivilantoffbi.com it's be fairly easy to detect, but if they're using unused bits in existing traffic, you're looking for the proverbial needle in the haystack without knowing what the needle looks like.

Re:Whatever

[Enigma_Man]

Excellent post. While it would be much harder to write the software for the myriad different ethernet chipsets that exist out there, this makes the most sense from a non-detection and information-gathering standpoint.

-Jesse

Re:Whatever

[Anonymous Coward]

ASIO is our FBI equivalent, ASIS is our CIA. Both are, um, not that highly respected and are seen as pretty incompetent. Something like this would be more likely to be done by the Australian Federal Police (AFP) or, possibly, the Australian Crime Commission (ACC), which deals with organised crime.

ASIO = Australian Security Intelligence Organisation
ASIS = Australian Secret Intelligence Service

(Obviously ASIS isn't that secret after all.)

Re:Whatever

[Kaa]

Sniffing your own traffic to look for unknown data of an unknown format in unknown packets at unknown intervals is hardly trivial.

If they have a stream of data going to server.autralianequivilantoffbi.com it's be fairly easy to detect, but if they're using unused bits in existing traffic, you're looking for the proverbial needle in the haystack without knowing what the needle looks like.

Remember, you control your own machine. It's not "unknown packets at unknown intervals" because you can make your machine emit (or not emit) exactly the packets you choose.

It shouldn't be hard to write a test suite which will generate normal-looking traffic and test what gets logged at the firewall against what that traffic should look like. Since you yourself are writing that test suite you know exactly, down to the last bit, what the traffic should look like.

Re:Whatever

[n00i3]

heck I agree man, we'll be seeing a new generation of geeks who write/customize their own operating systems; I'm getting started on mine these vacations :)

Re:Whatever

[Mal-2]

Looks to me like the computer geek is just going to become a staple of the successful organized crime family in Kangaroo-land, that's all.

W00t, a new sector for well-paid IT jobs!

Mal-2

Re:Whatever

[ajs]

It shouldn't be hard to write a test suite which will generate normal-looking traffic and test what gets logged at the firewall against what that traffic should look like. Since you yourself are writing that test suite you know exactly, down to the last bit, what the traffic should look like.

In your original message, you made it sound as if it would be trivial to detect such tampering, and now you suggest that you could write a test suite that should be able to detect such a thing, given a sufficiently isolated, known-clean baseline.

Those two outlooks are wildly different. Which one did you intend?

Re:Whatever

[ajs]

Both are, um, not that highly respected and are seen as pretty incompetent.

Ok, I'm trying to keep my tin-foil hat in the drawer, but you do realize that that is exactly what you want the public to believe, right? I mean, it's not really "conspiracy theory" so much as intellegence work 101: you don't display your competence if you can help it.

Maybe the Police can help me

[Anonymous Coward]

I live in Australia, and have forgotten my password I used for my password safe database. Maybe if I commit a crime it could show up as evidence. Police force more useful than brute force.

Just getting this now?

[Dan667]

In the US we have had Carnivore for years ... meh
http://news.zdnet.com/2100-9595_22-524798.html?leg acy=zdnn/

Re:Just getting this now?

[sTalking_Goat]

Carnivore was around long before it was called Carnivore. Its just a gussied up (or dumbed down) Ethernet sniffer

for that reason though Carnivore is more effective. It hard to detech a sniffer if placed on a point in the network your don't control. Spyware being directly on the client side machine is relatively easy to find.

so?

[SQLz]

obtain warrants to secretly install spyware onto users computers

Notice the have to at least obtain a warrent. In the US there is no such requirement.

Thank god I live in the US of A

[Anonymous Coward]

Where the dingos only eat the constitution.

How will it be installed?

[waynegs]

How do they expect to install this software? Send you some spam and hope you click on the link?

In other news

[DrMyke]

In other news, Steve Irwin arrested for animal cruelity after a "tip" led investigators to a web site that showed him .......... ..what is the world coming too... give me circa 90's internet...

Another useless law

[incog8723]

If they want to spy on their citizens like the United States, they already have the rights under law, and the equipment to do so. It's called a packet sniffer. They don't need viruses to do this kind of spying. If you're hooked up to the internet, you're wide open.

Re:Another useless law

[barfy]

Not AUL. Monitoring from the machine has two very useful purposes. First is circumvents and allows decoding of information that is about to be de/encrypted.

Second, it goes with the computer. Packet sniffers are network dependent, "spyware, or monitorware" is computer dependent

Slashdot paranoia surfaces again!

[Anonymous Coward]

What part of "with a warrant" is so hard to grasp?

How Will This Work?

[ronark]

Several things come to mind right away.

1. How will this work on a Linux machine?
With the security that is the hallmark of a Linux box, how do law enforcement officials expect to tap into someone's computer if they are running Linux? At best they could only monitor the user account they installed the software for.

2. Will this software work around firewalls?
This probably isn't really an issue, but it came to mind.

3. What if the user removes the software?
The article only said it was illegal to publish the existence of the software, not to remove it or tell your friends about it.

4. What if the user reinstalls their operating system?
An easy way around the problem. Just remove everything, and you're good to go. If the hard drive is cleaned out completely, there would be no way for the software to survive.

Obviously they have some serious work to do engineering wise. I'm interested in how they plan on executing this. Also, I do so hope that this law doesn't catch on anywhere else, and for the sake of my Australian friends, is revoked in their country.

Re:How Will This Work?

[SlamMan]

The whole point of doing this is that its not known to the user, just like a wiretap. If they left you a note day "There's government issued spyware on your computer. Go about your normal business," it wouldn't be all that effective.

Re:How Will This Work?

[kneeless]

With the security that is the hallmark of a Linux box

I hardly consider the security that Linux has worthy of the word "hallmark". It's better than Windows, sure, but it isn't secure (by default, especially) by any means.

Re:How Will This Work?

[theparanoidcynic]

Yes, Linux is more secure, but I wouldn't be too cocky about it. Don't think that the Federal Police can't find hackers good enough to r00t the average Linux box.

Besides, if they really want what's on your box they'll get a regular warrant and take your drives. Or, if allowed in America Jr., do a "sneek and peek", boot your system from a live CD, copy all your files to another drive, and add a special kernel module.

Re:How Will This Work?

[jimicus]

1. How will this work on a Linux machine?
With the security that is the hallmark of a Linux box, how do law enforcement officials

You're assuming that the software will be running on the persons computer in the first place. If they're doing anything that interesting with their computer, chances are pretty good that they're doing it across the Internet. So you go to the ISP and demand that whatever piece of spyware is installed. It's an Aussie equivalent of Echelon/Carnivore, with the bonus that law enforcement is legally entitled to use it, the system is legally entitled to exist and thus law enforcement can be fairly open about having done so should a court case come up.

How exactly the system works, however, remains a secret.

Re:How Will This Work?

[poptones]

1. How will this work on a Linux machine?
With the security that is the hallmark of a Linux box, how do law enforcement officials expect to tap into someone's computer if they are running Linux? At best they could only monitor the user account they installed the software for.

I'll probably be modded troll for saying this, but linux OOTB is LESS secure from this sort of attack than any modern windows. At least the win2k/xp variants will check out critical system files at startup, so if one of them is replaced it will be corrected. Linux isn't even that secure - one could replace any of dozens of executable files on a linux machine - or even just edit root level scripts with a text editor in knoppix - and make the system record every keystroke from login.. and you'd likely never know it.

But more importantly, you're thinking way too high level. Every machine has a BIOS and a boot sector, and most every PC uses the same code-compatible CPU. All it would take is two variants - a mac version and a lintel version. Stick it on the boot sector while the house is unoccupied and bingo. Better still, just flash it into the BIOS or infect the NVRAM.

This is but one example of the need for the linux community to get over the allergic overeaction to TCPA enabling technologies and work toward making linux the frontrunner in this regard. Any box will always be vulnerable to physical attacks, but there's a LOT we can do to protect our systems that isn't being done now on any ootb distro.

Couldn't this be accomplished...

[golfhakker]

by installing Google Desktop http://desktop.google.com/?

heh

[Janek Kozicki]

first they will have to break into my box. as I don't leave my computer with root logged in, in a terminal.

Re:heh

[Craigj0]

Physical access to your machine trumps whatever you could do. As mentioned hardware attachments or firmware changes could be used. Mounting the drive in a different computer to install software is also easy (why not replace the kernel? and any hashes for the kernel you have stored).

where are they?

[scubacuda]

What is the best way to record what these sites are doing? I mostly use Firefox and Konquerer. In both of them there are ways to fake your browser and make it look like you have IE installed when you really don't.

What's the best way to sandbox these programs to study them later?

Anyone have any links to these sites?

Re:where are they?

[egregious hack]

I suppose they could deliver the content in an ActiveX control, if you've not blocked that already.

Watching cookies accumulate on Firefox under Linux, I'd guess they'd have to be a bit more clever.

A sandbox could be a chroot environment on Linux/UNIX, trouble is network traffic is still going in and out.

Buy Alcoa stock now!

[beef curtains]

I get the feeling that Reynolds Wrap sales are going to skyrocket in Australia.

I wonder how those "Crocodile Dundee"-style hats would look when covered with tinfoil....

Re:Buy Alcoa stock now!

[Anonymous Coward]

Reynolds Wrap is alumnium foil -- is tinfoil the same thing?

Not a troll... I'm seriously asking, just curious.

Re:Buy Alcoa stock now!

[beef curtains]

I suppose this is a valid question...in fact, it got me wondering.

In summary, yes, yes it is.

Here's what I found:
http://en.wikipedia.org/wiki/Tinfoil
http://en.wikipedia.org/wiki/Tin_foil_hat

Well now,

[pair-a-noyd]

How much you want to bet that there's about to be a stampede to Linux down under??

Re:Well now,

[barfy]

Sure, I will take that bet....

I am willing to bet that less than 1% of those that are surveyed will even be aware of it.

I am willing to bet, that less that .1% of those that make a decision about what OS they use will make that decision based on whether the government will spy on them.

Re:Well now,

[drgreg911]

Now the next Microsoft-sponsored study on Linux will be "Linux: The Operating System of Terrorists"

Don't blame me

[Anonymous Coward]

I didn't vote for the lying rodent.

Seriously, anyone know what Canada's immigration policy is like? (Nothing personal Americans, but with a dropout running your country I don't really want to be there either)

Useful to have spyware now?

[trilks]

In this case, would it be useful for criminals (or whoever is being tapped) to install real spyware/adware that deletes other spyware/adware, thus getting rid of the gov't-sponsored spyware? I never thought I'd see the day that I would actually WANT to install Gator...

Austrailia Online

[CrazyJim1]

You've got jail!

AMD PIC - spyware free

[Anonymous Coward]

The AMD PIC might actually be useful in Australia! It's small, cheap, and you can't load software on it, meaning it's spyware free, Gurenteed!

This Raises Legal Questions

[Thunderstruck]

There are a couple of legal questions I would like to pose to /. about this.

1. Normally, when your government takes or uses your property in a way that prevents you from enjoying it, you get paid. If my government is installing software on my machine, that effectively occupies a portion of my hard drive and prevents me from storing data there. Thus, property is taken, should I get paid? If so when?

2. If I remove the software, am I destroying government property?

3. If the United States were to try to adopt a similar provision, under what authority would they do so?

4. If the computer with the spyware installed gets moved to another country, can the Australian authorities still use it?

Re:This Raises Legal Questions

[CK2004PA]

Yes nice legal questions. All of which were raised with phone wire-tapping, asked and answered years ago in court. Replace computer with phone and hard drive disk space with phone bandwidth & listening quality. Also replace uninstall with use hammer on bug. Next?

Re:This Raises Legal Questions

[barfy]

1. No
2. No
3. Under the Authority of the provision. As had been exercised in previous wiretap/patriot act/rico/conspiracy laws/
4. If they still have jurisdiction, probably yes. Undoubtably they will still use itl.

Re:This Raises Legal Questions

[Thunderstruck]

Regarding the phone: Space does not equate to quality of use. This principle was articulated in the Pennsylvania Coal case where the government prohibited mining a portion of the coal, but not all of it. Here the court noted that quality of use was reduced, but the property was not taken. No taking, no payment.

Where a government does not fully remove your use of a piece of property, it need not compensate you for a taking, such as with reduced quality on your connection. With software on a disk, there is a physical bit of space associated with it, something you can actually circle with a pen and show to a jury.

If all of these questions have been answered, how about citing me a case?

Re:This Raises Legal Questions

[YrWrstNtmr]

If my government is installing software on my machine, that effectively occupies a portion of my hard drive and prevents me from storing data there. Thus, property is taken, should I get paid? If so when?

Let's assume that you have a 120GB hard drive, with a street price of $100. Further, let's assume the 'spyware', takes up 500K.
"How would you like your 4/100 of a penny, Sir, in cash or check?"

Re:This Raises Legal Questions

[Thunderstruck]

You're absolutely right about the value, it is incredibly small. However, it is still measurable, and therefore still recoverable. The important part is not the 4/100 of a cent one gets in return, rather it is the fact that payment for the occupation, if constitutionally required as a taking, gives me notice that something is going on.

Re:This Raises Legal Questions

[maximilln]

How come they don't use this kind of math against those evil media sharing people? Let's see, the album went triple platinum (what is that, 3 million copies?) and I distributed 4 copies of track 7 out of 12... so your estimated damage is 1/12 * 4/(3 million) * $16/ea.

Possible scenarios

[Spy der Mann]

Scenario 1:
Your honor... we obtained the warrant to install it. But we don't freaking know how to do it!
(His honor: ) Argh! Damn Linux!

Scenario 2:
OPEN THE DOOR! POLICE!
(hacker deletes everything from his computer using a three-finger hotkey)
Yes, officer? How can I help you?
We're here to install some spyware on your machine. We have a warrant.
Oh sure, come in.
(half an hour later...)
(hacker unplugs his PC. Runs anti-spyware, and reboots)
*whistles*

Re:Possible scenarios

[KingPunk]

there is another approach also, its called tripwire,
it makes hash keys to every file on your pc, or place you specify.
as to thward and detect any corruption, or malicous issue.
(which this would be great for, mind you.)
and then you can just simply boot to a rescue disk of some sort,
and instruct tripwire IDS (intrusion detection system) to remove every unknown file,
or ones at your chosing.
...of course, this is only good if its a software attempt at "wiretapping"..
hardware is a totally diffrent story.
but there are ways for that too ;)

Re:Possible scenarios

[anagama]

• 
  Scenario 2:
  OPEN THE DOOR! POLICE!
  ...
  We're here to install some spyware on your machine. We have a warrant.
  Oh sure, come in.
  (half an hour later...)
  

A half hour? I would think it takes a couple days to get all the dependencies right. Some will be an easy rpm install, but two or three will have to be compiled using an outdated set of dependencies that're impossible to find anywhere and which recursively rely on other impossible to find dependencies. Eventually, the cops give up in frustration and demand that our hacker install RH9 with a custom kernal. Hacker complies, scripts out non-nefarious usage patterns for that machine and moves on to a different one.

Time to put spyware on their systems...

[Anonymous Coward]

and find out what is going on. Oh wait, they run Windows. Now it is time to find out who has the info.

removing it by reinstalling windows is the way

[marika]

It can't be illegal to reintall your os. It makes me wanna reinstall Windows ME. A required periodical format+reinstallation of the OS can only make one safer.

Re:removing it by reinstalling windows is the way

[Anonymous Coward]

Yeah, but then you will have to do that every time you turn on your computer.

Ok, here's a question...

[Weaselmancer]

If you're an alert user, and you find this task running on your machine, and you remove it...

Are you guilty of the Australian version of Obstruction of Justice?

If so, you could commit a serious crime by simply running a spyware scanner.

Re:Ok, here's a question...

[barfy]

No you are not guilty of OJ.
It is extremely unlikely you would find this as a "task" running on your machine.

Re:Ok, here's a question...

[myowntrueself]

Or just reformat your drive and install Linux... you might expect a visit from the boys in blue, and I don't mean IBM.

Seriously, if they can't snoop Linux too, they have a problem and the authorities just love making their problem *your* problem.

Re:Ok, here's a question...

[corbettw]

Or just reformat your drive and install Linux

What makes you think this would run at the OS level? It would make a lot more sense to install this on the BIOS, or as someone else pointed out on the video or network card, and snoop traffic going across the internal bus of your computer. No CPU fingerprint that way, and it would be OS agnostic.

How do they get it on your PC to start with?

[magicRob]

Subject: Update or verify your account informations

"we have detected a slight error in your billing information...

This might be due to either of the following reasons...

Please update and verify your information by clicking the link below..."

Or perhaps a link to dialer.exe

Wonder how many people would fall for that old one

- Rob

You can't what?

[Anonymous Coward]

You cannot hide things from someone on their own computer.

There are millions of people out there who, having achieved the technical acumen to set the time on their VCRs, never programmed them to record anything because that's hard. You could hide spyware from them on their desktops if you just give it a name they can't understand. SYSTEM TOOL THAT ONLY SMART PEOPLE UNDERSTAND.EXE might be slightly too obvious for some of them.

A license to phish...

[bani]

...what will those australians think of next?

Easy fix, sort of.

[Gerdia]

Use a laptop... use OpenBSD... encrypt your entire drive... carry it with you everywhere, sleep with it under your pillow.

Re:Easy fix, sort of.

[barfy]

This is precisely the need for the law. To see your stuff, while your system is running. Maybe it lives in the Bios, or the kernal... Hmmm....

Ghost

[somethinghollow]

I guess the easiest way to make sure you aren't being tapped is to 1) put all your data on a removable disk, 2) use IMAP for mail, 3) Fresh install your OS with all the programs you want 4) Ghost (or some other backup tool) your install 5) reinstall the backup as often as possible. (optional: 6) PROFIT.)

It might not keep the spyware out, but it will at least make it a pain in the ass for them to keep it on.

Re:Ghost

[Anonymous Coward]

2) use IMAP for mail

Not so smart. With just a court order they can obtain all your e-mail from your provider without you even knowing it.

Re:Ghost

[corbettw]

I guess the easiest way to make sure you aren't being tapped is to 1) put all your data on a removable disk,

That's a good idea. You should encrypt all your files, too.

2) use IMAP for mail,

That's a horrible idea. Now all of your mail is outside of your control, and the Feds can access it without you ever knowing.

3) Fresh install your OS with all the programs you want

Don't bother, whatever they use probably won't be installed at the OS level. Which also renders moot the rest of your ideas.

The link

[pair-a-noyd]

crashes the crap out of Konqueror 3.3.2

Maybe that's the Kangaroo Kops trying to install an M$ bug in everyone's browser...

Re:The link

[Anonymous Coward]

Use Firefox.

You can already do this to your employees...

[farsideofthemoon]

with DynaComm i:scan... see sig for link... I'm telling you guys this is what the world is coming to... =)

Re:You can already do this to your employees...

[LittleLebowskiUrbanA]

Bet this organization of volunteers will disagree with your vision of the world. Also, try running your product against OpenBSD. Companies like yours make me glad Theo de Raadt's such an asshole who went his own way.

Can you say "circumvention device?"

[crimethinker]

Of course the next question is (besides the privacy concerns) is using programs such as AdAware and Spybot S&D to remove said Federal Spyware illegal. My guess would be yes but I also suppose that the people who would be getting these "taps" on their computers won't care much about the legal reprocussions of removing them.

The real target of making it illegal to remove federal spyware would be the makers of spyware removal programs, who have a lot more to lose than someone already under heavy surveillance for illegal activities. The authors will be threatened, a la the DMCA, with "trafficking in circumvention technology" and I'll bet good money that the feds can bring enough charges to make them fold like cheap suits.

Never mind this particular story is happening in Australia; we either have done it or will soon do it here in the USA. Our federal government specializes in "conviction by overwhelming force," where they threaten so many charges that add up to twenty life sentences plug two lethal injections, the target pleads guilty to one chosen charge to avoid the gamble.

I love my country, but I fear my government. Reason magazine put it best a few months before the election: "The good news is that on Nov. 2, one of these men will lose. The bad news is that the other one will win."

-paul

Re:Can you say "circumvention device?"

[gcaseye6677]

Making it illegal to remove "government" spyware would certainly make the police and the politicians feel better, but would have no effect on any real criminal who knows what they're doing. They could just download the "foreign" version of a spyware removal tool which doesn't have the US spyware exemptions, hosted on a server in a country that doesn't give a crap about US trade regulations. This type of spyware will catch stupid criminals or those that just don't plan to get caught, but anyone who really takes action to avoid it will be able to defeat any government installed spyware.

I dont care

[eneville]

I don't care! I use Debian and am only ever logged into user space.

I do not run sendmail/bind, the two must buggy and exploitable programs (on UNIX), so how does this help the police? Do the real criminals move to a platform where they can get security from the police, or are they too dumb, or confident to do this?

Would someone who runs Norton Personal Firewall who blocks this be held against the charge of obstruction?

Re:I dont care

[lwoggardner]

There are no remote exploits required to install this stuff.

Your Debian system will be susceptible to a physical attack. Like when the cops break in to your house (legally, with a warrant) and install this software along with cameras and other bugs etc...

Geez, haven't any of you guys seen Stingers.

Re:I dont care

[eneville]

I had forgotten about what may happen at the ISP level and evesdropping of that nature.

As for physical attack, encrypted filesystem will keep whats mine as mine for a while longer.

I do nothing illegal, I run a free OS and have no license fees to worry about like others. Its just the plain principle, it will be like fighting spammers over inbox content, but instead, for privacy.

Thoughts

[doombob]

I heard once that if you found a tracking device on your vehicle installed by the police, you cannot remove it since it was installed because of a warrant. I'm sure spyware installed because of warrant would fall under the same type of law. This, of course, is in the United States, and not the land down under.

Re:Thoughts

[jimicus]

Typical governmental logic. Prevent criminals from removing the tracking device by making it a crime to do so.

An imaginative criminal could easily work around that. I like the idea of pushing the car off a cliff.

Not my Porn!!!!

[Anonymous Coward]

They sound as bad as the United States trying to rid the world of weapons of mas-turbation.

The passed a law but what now...

[meplaysocr]

They did not mention how they would get the spyware installed on the computers. Personally, when I'm not near my computer, it is password protected. And I'm not logged in as root either, so how do they expect to go install software on peoples computers without them knowing? Will it be like in the movies when then come as electricians and ask to check your meter while putting in bugs/cameras? Will they now come as Geeks asking to check your computer for virus's while they install their software? What about with Macs or those that use Linux...Sure they got themselves a law that lets them do this...but makes you wonder how much success they will really have at it.

Re:The passed a law but what now...

[Anonymous Coward]

Somehow I don't beleive this act really relates to software. There are keystroke loggers that are hardware based and do not require logging into the machine to install. Between that and monitoring your communications link, they've pretty much got all the data they need, don't they? Again, it is the same as installing a listening device -- they need to sneak in and install it when you're not there. Now, if you're REALLY paranoid, you could install a camera with a motion detector to detect whether anyone has been tampering with your computer whilst you're not there...

Re:The passed a law but what now...

[meplaysocr]

Actually I have a camera on my computer, that is motion activated. Installed it when I was living at home and my brother would break into my room and steal stuff.

As for the hardware key loggers, I think I would notice if someone hooked something to my computer to capture keystrokes, though this brings up an interesting thought. Wireless keyboards/mice. Intercepting this signals and capturing keystrokes that way. Might have to go back to using a regular keyboard now as I've given myself paranoia.

With link monitoring, you would just want to use encrypted communications, which for me all my email is done through SSL and I use SSH for remote connections so that should provide one with a little protection right?

No More Spyware Companies

[hakr89]

This could put an end to the spyware companies since they would be preforming illegal wiretaps when they install their software on your computer. Though this would only apply to the ones that track browsing habits, but that's part of what most of them do.

the scary thing is...

[spoonyfork]

... Australia didn't already have this as part of their legal system?!

Gmail invite

[Anonymous Coward]

http://gmail.google.com/gmail/a-95c522b451-459b5a3 bf7-f6576ec084

Re:Gmail invite

[Anonymous Coward]

Posting plaintext so you know where you're actually going.

http://gmail.google.com/gmail/a-e2f8b71b98-d8569 43 4f5-e82e2cb0af
http://gmail.google.com/gmail/a-e2 f8b71b98-71ff197 254-7e45b8ddd9
http://gmail.google.com/gmail/a-e2 f8b71b98-6d0196a f75-065ce92a82

So how do they install this?

[Anonymous Coward]

Does one cop knock on the door and say "Hey! Look over there!" while another cop sneaks in the back door with a CD-ROM and install the software?

no problem here

[Anonymous Coward]

Just use a Linux Live CD and you will be set.

Of course, if you are this paranoid, you probably deserve to be spied on and in jail anyway.

RUN OS OFF OF A CD

[Anonymous Coward]

I am becoming more of a fan of booting your
computer off of a CD a la KNOPPIX. This will
prevent 99% of all viruses, and, I believe
severely frustrate these types of efforts.
I guess they could clone your cd and add
a few programs, but what obout the random scratches
on the surface, one of which may have been placed
there by you. Couple this with a good firewall / NAT appliance and some good encryption services and
you can still run your international smuggling operations.

I'll tell you why...

[Anonymous Coward]

No way I'm gonna post this under my real nick...

It's all starting to make some sense now.

Life is like a huge puzzle with most of the pieces missing. But I think I'm starting to see some of the more important pieces falling into place. And let me tell ya. It doesn't look too pretty.

Long thing short... It has to do with the blood for oil project the government has underway. This thing the constitution had setup was getting in the way of what satan was trying to do.

So this is just another thing that shall come to pass to enslave the populus into doing the bidding of their master.

Don't believe me? Well, surf on over to http://www.thepowerhour.com and check out that 911 in plane site video they offer.

Want a poor man's copy? Fire up your torrent and surf over the suprnova.org and get that torrent link to the same video at about 100MB AVI format.

It's just one of those pieces in the puzzle that they didn't want you to see.

I await the black helicopters now.

Re:I'll tell you why...

[Anonymous Coward]

I saw the video and if you ignore the really bad nut-job conspiracy-theorist logic at the beginning it's not bad. Don't believe a word they say about the images, just look at them and decide for yourself. It would have been much better and taken more seriously if they'd left the crackpot logic out of the beginning.

Wire Tap my ass

[Anonymous Coward]

At issue here is more than just a wire tap, that can be done utilizing the PSTN.

This falls under the same disgraceful process of sneek and peek warrents. A person has an innate right to be secure in their effects.

What bothers me...

[Anonymous Coward]

secretly tampering with your physical property with only 'reason to suspect that a crime may or may have been committed', coupled with the fact that it is also illegal to publish information about any such secret warrant/spyware. the deciding factor is that the crime in question must carry a MAXIMUM of 3 years jail time.

yep, thats right, they can spy on you for thinking about talking about their spyware...

Re:What bothers me...

[La Camiseta]

Aah, but what about us who aren't in Australia, and even better, those who are in non-extradition countries? It may be illegal for Australians to do that, but what would happen if you were to just send an image of your system to someone out there who were to disassemble it? Or are they going to make it illegal to transmit information outside of Australia?

The beauty of laws is that there's always loopholes.

Big deal...

[La Camiseta]

I guess that they'd freak out if you ran everything from an OpenBSD box with everything encrypted, good PHRASE passwords, not single words, phrases, and used an encrypted connection as soon as you connected to the internet, and regularly inspected your hardware for indications that it'd been tampered with (or just carry your system with you at all times). And had your system check for rootkits and run something like tripwire against a nonvolatile piece of memory (like a SD card) every time you booted up.

Of course then you'd just be a paranoid freak, and probably deserving of the tapping of your system.

Re:Big deal...

[hesiod]

> Of course then you'd just be a paranoid freak, and probably deserving of the tapping of your system.

What you are saying: "If you're paranoid about being falsely accused of being a criminal, you are one and should be treated as such."

Aussies! Run as a Limited User to avoid your cops!

[gfecyk]

It's not like we don't already see spyware installed behind one's back when visiting certain web sites.

Then I'd like to see the first judge that orders you to run your computer as Admin so they can install spyware behind your back.

Is anybody else seeing an easy go-around?

[seaniqua]

Maybe I'm missing something. Let's say that criminal #1 is keeping records of ill deeds on his pc. Then this announcement goes out that the govt. now has the power to install copware on your computer. Wouldn't all but the dumbest criminals (who would've been caught anyway) simply disconnect their box, and use a non-incriminating computer for internet? Or a firewall?

Re:Is anybody else seeing an easy go-around?

[Dr Damage I]

Suppose the cops want to know what is in encrypted files on a suspects computer: If they can get a warrant to install a keylogger on the suspects computer (without informing said suspect) 10 days later when they show up at the door with a warrant to seize all electronic hardware (ala Steve Jackson Games) All they have to do is pluck the passphrase for the encrypted files out of the keylogger and bobs yer uncle. (Assuming the suspect used the passphrase during the intervening days). No internet access required. Assuming the cops can get physical access to the machine without the suspect being aware of it, it works just fine

which raises all sorts of questions about overt and covert physical security... keeping computers locked up in a strongroom would do it, as would having telltales which would alert the suspect to the fact that their computers security has been compromised

Hmmm, I wonder..

[sizzzzlerz]

How do they get the perp to install Real Networks or Kazaa or make them clicking on the jumping Monkey?

Hello...

[Anonymous Coward]

and welcome to the world of facism.

Look around you boys and girls, you don't have any rights at all anymore. Have fun before it sinks in. We are now PRODUCT, to be traded amongst the elite.

Better yet: Run Windows like Linux: Not as Root

[gfecyk]

It doesn't take a switch to Linux to get Linux-like protection.

Get Win2K or XP and do your daily work as a limited user. Stick with apps that work as a limited user (Yes, this means dumping Quickbooks for Simply Accounting). Ditch or fix the games that need Admin to run and tell your vendors to clean up their act. Take charge of your PC already and stop blaming Microsoft.

Re:Better yet: Run Windows like Linux: Not as Root

[hacker]

And exactly how does this prevent someone from monitoring your machine's activities, either locally or upstream remotely?

Answer: It doesn't.

Re:Better yet: Run Windows like Linux: Not as Root

[linguae]

That's correct. You also need a firewall. Windows XP comes with a firewall, and there are plenty of software personal firewalls for Windows 2000/XP, and there is always the hardware firewall route (either by obtaining a router that includes a firewall or by using an old Linux/BSD PC dedicated as a firewall).

Re:Better yet: Run Windows like Linux: Not as Root

[hacker]

And what do you do when these spyware applications simply ride over "allowed" protocols, through your firewall, like http, dns, and so on?

They're already starting to do that now, to avoid detection.

Re:Better yet: Run Windows like Linux: Not as Root

[The_Wilschon]

Your sig. honestly. Did you even read the article you linked to? Yes, the author is correct that there do exist viruses which attack Linux and MacOS. There do exist exploits available and security holes in Eudora, Evolution, Firefox, you name it, its got a hole. I sincerely doubt that there is any large piece of useful software which is completely free of security holes. However, there are reasons why Linux (Evolution, Firefox, pick your alternative software) is more secure. One (Just one) of these reasons is that these alternatives are less common. Thus, people seeking to do the most damage tend to avoid them. However, other reasons exist. Among them are a great many fundamental design issues with Windows and IE (ActiveX being one of the most well known), the fact that Microsoft frequently fails to patch known holes for months, and of course the fact that the coders who write most of this alternative software are aware that one reason many people do use the alternatives is that they are more secure, thus the coders place a special emphasis on writing secure code and maintaining it responsibly. And of course there is also the fact that the majority of Linux users are geeks who know how to make a box secure... as opposed to your average Joe-M$-biatch who doesn't know a firewall from a flamewar. Not that that has anything to do with the inherent security of the system, but it helps for the same reason as the relative rarity of the system type. Exploiters know that a linux virus will do a lot less damage than a windows virus.

Re:Better yet: Run Windows like Linux: Not as Root

[arminw]

...It doesn't take a switch to Linux to get Linux-like protection...

How about OSX? No programs I have installed require admin status and the root account is disabled. To install any software I have always had to enter the admin password, since I run as a regular user. Also, if I DID have something to hide I'd turn on the data vault encryption capability. How they would install spy software without my knowing about it is something I cannot think of. If they DID take my computer away and later gave it back I'd reformat the HD and re-install everything from backups and turn on the encryption. If the encryption is turned on, the keystrokes caught by a hardware keylogger would end up in an encrypted file as well unless keystrokes were sent over the Internet before encryption was done. I'd certainly notice Internet activity when there was not supposed to be any, such as when I was not even running any programs other than the Finder.

Re:Better yet: Run Windows like Linux: Not as Root

[arminw]

...there do exist viruses which attack Linux and MacOS....

I have not heard of any malware that can install on a Mac and affect the system unless the user knows the admin password. As an ordinary user, I have NEVER been able to install or run a program for the first time without having to give the admin password. Users get a warning if a program wants to open that has never run before and the list of where the permitted, established, programs is kept cannot be accessed without the admin password.

To install secret software on a Mac, the cops would have to take the Mac away for a while and then bring it back. They'd have to know the login password. If they booted from another disk or an install CD, they could get access, but not under my present password -- they'd have to assign a new one and then I could not get in afterwards. If I know or suspected my Mac had been messed with I'd reformat the HD or install another one in its place and re-install everything from backups. I never give the admin password to anyone nor to any request that I do not initiate.

A computer-wise criminal would not be caught by such tactics, at least not on a Mac. If I were such a criminal, and my computer had evidence that could put me in prison for many years, I'd claim the 5th amendment if an attempt were made to force me to reveal the passwords. I'd also have the built-in encryption vault enabled that every Mac has available. In countries where there is no 5th, I'd take my chances with contempt of court.

Look ma, no hard drive!

[kfg]

Knoppix rides again.

KFG

Knoppix, anyone?

[gargonia]

Seems like Knoppix pretty much makes this completely useless. Even if someone is able to code up a Linux version they won't be able to install it on a non-persistent system. I'm sure everyone in Australia won't start using Knoppix (or something like it), but all the criminals they're trying to catch will!

Re:Knoppix, anyone?

[the.odd.byte]

Yup, just about to type the same! Any linux-live cd & a usb key and the whole system goes out the window (sorry - no pun intended...) So law enforcement is still, oh, I guess, about 3 years behind.... Does that make linux live cd's illegal, as they circumvent the law???

Re:Knoppix, anyone?

[jimicus]

but all the criminals they're trying to catch will!

Assuming, of course, that the criminals are also computer-savvy enough to use Knoppix and strong encyption end to end for everything they do.

The subset of computer users that have even heard of Knoppix is small. I'd be willing to bet that for all but the most organised of criminal rings, the same can be said. And if the criminal ring is that organised, it will take more than a few software taps to bring them down.

Coming to a Court Room near you...

[feloneous cat]

"Yer honor he was using Windows and..."

"That's enough for me! I sentence you to life!"

Re:Coming to a Court Room near you...

[Anonymous Coward]

Making Windows so highly illegal might not be a good thing! You know, a lot of people find highly illegal (but outwardly harmless) things fascinating, simply because they're illegal. Please, let's not make Windows the KwEl IlEgUl OS!!!1!

Freeze

[KeyboardMonkey]

This is the police!

We have taken control of this slashdot account.

Anything we say can be used against you in a court of law...


Now really, if your computer can be infected with spyware, what's to say the courts can prove you are responsible for what is done on your computer?

What's wrong with the UK and Australia?

[LittleLebowskiUrbanA]

Now this spyware issue, the banning ceremonial swords and toy guns, crime rates rising, and the security camera epidemic. How much freedom are the citizens of these countries willing to give up?

Re:What's wrong with the UK and Australia?

[FrostedWheat]

the banning ceremonial swords and toy guns

Ceremonial swords I don't understand, but toy guns I agree with completly. They are horrible things and I for one would be glad to see a lot less of them.

Re:What's wrong with the UK and Australia?

[evanism]

Give up freedom? We all ready have my friend. Our "appearance" of freedom is an illusion. Our Modern governments have us in an iron fist tighter than the commies of old. Electronic surveillance is absolutely everywhere... cameras, video, eftpos, tax returns the whole lot. I, for one, have completely given up. I am resigned to the fact we cannot "beat" our government, for they make the Illegal Legal, and the Unethical Ethical. The Immoral Moral. Our govt has created the perfect enemy... one that doesn't truly exist, but lives beneath every rock. An enemy that can be labelled at will, and one that with SAFETY and FREEDOM* (*freedom is a Brand, for it does not mean free) in mind can be bandied in order to pass the most usurious of laws, all without public complaint. We are now Safe, and Free, but without Safety and Freedom as our govt now has Control. I fought the Auch-tray-ya card, but now, ye citizens, prepared to be identified. For Identity Will Set You Free. Do you honestly believe this will stop here? Do you think the police will voluntarily not snoop on our innocent activities? Do you honestly believe that they wouldn't read every email/listen to every conversation if they could? If you believe that police wouldn't record everything if they could, you are an idiot, and ignorant. They CAN, and the WILL and they WILL USE IT AGIAST YOU. Our concept of who "WE" are is OVER. The government is the enemy. The government is about CONTROL, and ensuring you all remain good tax-paying meat popsicles. It is not freedom we have, for that is now suborned.

Re:What's wrong with the UK and Australia?

[hesiod]

> toy guns I agree with completly. They are horrible things

Without toy guns, how will we glorify government sanctioned murder and staff our future militaries?

Seriously though, how is a toy gun a horrible thing? Do you also think that candy cigarettes should be banned? I think those are dumb and may perhaps contribute to the illusion that smoking is "cool," but I don't think they should be illegal because of that.

A ceremonial sword has no practical purpose, unless that ceremony involves killing or dismembering something. Therefore, ceremonial swords are of no practical value and should be forbidden. They are only used by "special" rich people to give them some false look of superiority and authority. Plus, a sword can actually hurt someone. Toy guns hurt no one, unless they break & you cut yourself on plastic edges.

You know what's really horrible? Making things illegal for no reason other than "I don't like what it's imitating, even though it is a real, prevelant thing" & "I said so." The games Risk, Axis & Allies, and even Chess are based on war. War is horrible. THOSE GAMES ARE HORRIBLE and should be made illegal. There is the same justification. If toy guns (a physical depiction of a real thing) are illegal, you MUST make it illegal for guns to appear in video games. That's a virtual depiction of the same real thing. What's the difference? With a video game you can fire it and see blood, you just can't hold it in your hand. With a toy, you have to yell "BANG!" and hope your opponent plays dead.

Re:What's wrong with the UK and Australia?

[FrostedWheat]

Seriously though, how is a toy gun a horrible thing?

Seeing kids play with toy guns is something I find wrong. I personally wouldn't make a law on the matter, I think it should be up to the parent. The UK is becoming a right granny state at the moment and the last thing we need are more nanny laws.

Re:What's wrong with the UK and Australia?

[hesiod]

> > how is a toy gun a horrible thing?
> Seeing kids play with toy guns is something I find wrong.

You didn't answer the question. Can you expound a bit on why it is wrong? Is it because it can be (and probably would be) used to imitate an illegal/immoral act, namely murder? Kids have played with toy guns for a long time, I don't get why it's such a bad thing all of the sudden. Would you scold your child for using a "finger gun" (ie, you point your finger at someone and yell "BANG!")? It's the same thing with slightly more imagination.

If this is the case, does that also translate to digital? Do you see kids playing Halo (or most any other video game) to be wrong as well? It's imitating the same thing, only you can't touch the item, point it yourself, and it's more realistic.

Slashdot logic errors..

[barfy]

1. The technology is flawed therefor it is useless.
No, there is no real connection between a technologies flaws in all conditions, and it's usefulness in some conditions.
2. The government will know everything about me.
Unless there is a warrant out on you, the government likely gives a two-hoots against you. This is NOT echelon :)
3. It will be easy to remove by any idiot.
Not, likely. The technologies to make difficult to know that it is running on your machine are well known. And truly most idiots do not know what is running on their machine, and criminals tend not to be criminal masterminds. Mostly they are just stupid criminals.
4. There are already laws.
No, monitoring laws are very technology specific. Monitoring software requires it's own laws.
5. There is no reason to do this.
Powerful encryption requires LE to do something like this in order to capture keys and information to be used against the badgus.
6. Government intrusion bad!
Well, yes. That is why the 4th Amendment exists in the US, and there are pretty powerful privacy laws in most western democratic societies. But All of them carve out exceptions to prevent activity that is harmful for the social good. (criminal and seditious behavior for the most part). The difficult part is how to balance between a blind and ineffectual enforcement activity and an all knowing overly effectual (we all sin, so some say. Holiday Greetings all!) government enforcement activity.

Simple M$ fix.

[crovira]

The govt.(s?) won't ALLOW Linux. You'll HAVE to run with Windows because it can be infected.

Sucks, don't it.

knock knock

[netsfr]

cops come knocking at the door. suspect opens door. cop states he has a warrent to install some "software" on the computer. suspect leads cop to IBM XT in the closet. no problem.

Earthpol.

[rice_burners_suck]

I think there should be a worldwide police force. Let's call it Earthpol. This organization will have the right to use any methods necessary to catch any kind of criminal. Basically, they will be above any law in any country, and will be able to commit any crime that nonmembers of their organization cannot commit. Also, they will serve as police, prosecutor, judge, and jury. People will be arrested and immediately sentenced. The minimum mandatory sentence for any crime is 40 years in solitary confinement. This organization will go around and terrorize people, demanding payment for "protection" services. Those who do not pay will be arrested for some crime. Earthpol will not have any burden of proof. All will be considered guilty until proven innocent, and will NOT be given any chance to prove themselves innocent, or to make any attempt to do so.

cat and mouse

[trb]

Like any other bug (transmitter, not software error), this would seem to rely on security through obscurity. If the person under surveillance (snoopee?) knew he was being bugged, it would be easy enough to foil.

Crooks use things like radio scanners to look for wireless bugs. They can use tools to search for such spyware, essentially tools like Adaware or virus scanners or sum | diff.

Once crooks find out how their systems are compromised, spyware removal tools can do their work, and crooks can take evasive measures. For example, installing many sets of OS binaries, DLL directories, registries, etc, on each machine. In different directories, different file systems, different disks, whatever.

You could play all sorts of cat and mouse games. Sounds sorta like fun, except, guilty or not, it's probably not fun having the heat on your tail.

Vile, but expected

[shinyplasticbag]

Alright, this does feel a bit rotten, but it's really no different than wiretapping, which we've all grown accustomed to the spectre of.

The question is, if the suspect finds and removes the spyware, what happens next? Will the police charge them with obstructing justice? What if the spyware has a negative effect on the operation of their computer -- can the justice system be held liable for damages? Are they planning on making cross-platform spyware, or will Windows users be the only one to suffer?

This so-called powerful new means of gathering evidence isn't quite fully baked, and I doubt it will be for the foreseeable future.

Hiding

[ithmus]

You cannot hide things from someone on their own computer.

Of course you can. Don't even kid yourself. Malicious code can be embedded into existing system utilities. Completely original malware can be hidden amongst many other files in system directories. Plug-ins can be hidden in the registry.

There are 1000 places to hide something, and you're never going to find them all. If you delete 999 occurences, the single one left will rebuild them all. (in new and different hidden locations)

The only really effective manner of completely ridding a PC of a malicious spyware infection is to re-install the OS. Your other option is to turn off the computer and go back to pencil and paper.

New business opportunity

[Chatmag]

Signs will be popping up all over Australia: "Hard Drives replaced while you wait"

What if it were hardware based ?

[Anne Honime]

My guess is that spywares would be difficult to find if they are embeded into wires (say from keyboard to case) ; would work regardless of the operating system, and would need sharp eyes to get spotted.

Re:What if it were hardware based ?

[Anonymous Coward]

Hardware spying on computers has been common for a while, including little chips that are inserted into the plug of a keyboard to record strokes. I heard a rogue stock trader was once busted by a keyboard logger like this. Police serious about spying would use hardware. Spy software can be easily removed, easily manipulated, and probably harder to gain a conviction with.

Windows users

[towaz]

Yeah like all the people they are wanting to spy on use windows?

I thought about this a few years ago and the most that could be done is monitoring your traffic at the isp.

Due to this the only internet service that is not always encrypted is email (still pgp on important stuff).
newsgroups are encrypted, irc is encrypted.. even the web is encrypted now through certain providers.

I don't have anything to hide but I have a right to privacy :)

Re:Windows users

[cayenne8]

"Due to this the only internet service that is not always encrypted is email (still pgp on important stuff). newsgroups are encrypted, irc is encrypted.. even the web is encrypted now through certain providers."

How do you have encrypted newsgroups and irc? How do you encrypt http traffic unless the server you hit is running SSL...which I only see for transactional sites....

Links? Search terms? I'm interested in this...

Re:Windows users

[towaz]

ok here are some examples though some cost a little.

Most IRC servers support ssl. in BitchX do:-

BitchX -SSL irc.foo.com 7000 (could be .com:7000) most servers tell you what the correct port is for ssl.

Xchat has the ssl libraries static so you can use it in windows aswell. /server -SSL irc.foo.com 7000

both clients suffer on openbsd though so just setup stunnel if required I think they are both ok on freebsd now but not checked.

Newsgroups - well this is not a free option www.easynews.com offer secure connections and ssl downloads https://secure.members.easynews.com but can be a bit expensive.. or just use the ssl port on the easynews nntp server.

www
Again only free if you look hard enough but http://dmoz.org/Computers/Internet/Proxying_and_Fi ltering/Hosted_Proxy_Services/ supply some good subscription based proxy services which just setup a vpn through your browser so no need to install a client.
http://red-library.com/ have a proxy section if you don't care about encryption for normal browsing though.

years ago they was a very cool client from http://www.freedom.net/ I have not tried it recently due to staying with linux and openbsd. But it would encrypt any of your traffic through its servers, encrypted in layers which was rather hard to trace...

here is a small writeup on onion routing. http://zoo.cs.yale.edu/classes/cs490/00-01b/oh.jas on.jeo8/section5.html

they are alternatives some odd p2p implementations floating around ect.

As always things can be used for bad aswell as good.. does not mean such services should seise to exist :)

hope this helps

I still see a problem.

[Anonymous Coward]

I like that due process is still required. And, if all they were doing is tapping internet activity after obtaining due process, I would be fine with it.

However, I don't think it is acceptable for them to install software, secretly, on the person's computer. That, in my opinion, greatly exceeds boundaries of privacy and personal liberty. Perhaps they should secretly install a camera in the person's bathroom too? You know, becuase thats where she has her meth lab set up....

I hope the people of Austrailia push back against this one.

Rename that law

[HangingChad]

To the Windows spyware law. Good luck getting that installed on any of my home machines. It would take them a long time to hack their way in from the outside. Executing a sneak-and-peek would require getting past the dogs...I would pay money to watch that.

They can sniff my packets because that's all they're going to get.

Re:Aussies! Run as a Limited User to avoid your co

[meplaysocr]

I suppose the Justice Department or whoever could just send you an email saying you've won a trip to (insert location here) and have you click a link to 'download' your trip planner software. Or they could always go with the porn route, directing you to a website with some nasty active X scripts and what not. Glad I use mozilla.

Check out SELinux

[pherris]

Fedora SELinux FAQs
Security-Enhanced Linux
SELinux for Distributions
The UnOfficial SELinux FAQ

Quite honestly most any GNU/Linux distro will slow them way down (assuming their not using a hardware keyboard capture device). If they get get physical access to your machine you're screwed reguardless of the OS.

Re:Check out SELinux

[Anonymous Coward]

SELinux? Jeeze, considering most police officers can't even spell Linux I bet just using plain old Linux would fix their little red wagon. Very true about the physical access issue. A small thermite charge on the hard drive triggered by the case openning will fix that. =)

Fedora SELinux

[Anonymous Coward]

I just started running it and am quite impressed. Not an easy setup but still not bad at all. If anyone is thinking of trying SELinux IMO Fedora is the way to go.

Technological arms race

[xnot]

Passing laws like this serves no one but the government. It's the same thing as creating a law which is too complicated for the average person to understand. You need legal training just to have a ghost of a chance at fighting your charge. The same way here: those that are technologically-deficient and don't know how to install anti-spyware products, they are the ones that lose.

Call me crazy, but I believe that the capablities for government surveillance should only increase to the same level that people have capablity for counter surveillance. The government is not automatically right and the people wrong. People are supposed to be free from "unreasonable searches at seasures", yet I somehow doubt that the Founding Fathers could envision a time when searching would be undetectable by the person that was searched. How can a person be assured that the search was reasonable if they don't even know that they've been searched?

Re:Technological arms race

[Anonymous Coward]

OK you crazy! :)

You have mail...

[the.odd.byte]

... from the Australian Federal Police. We have obtained a warrent to monitor your computer. Please visit this web site (insert link here) so we can install our spyware (sorry, monitoring software). Note that to use this software you must be using Windows 2000 or later with Internet Explorer 5.5 or later. Please make sure your system meets these requirements before visiting this site.

Spybot S&D?

[amigabill]

So, if I have Spybot Search & Destroy or another of that sort of utility installed, and it removes the spyware I'm not supposed to know about being there, am I guilty of tampering with evidence or something?

Re:Spybot S&D?

[M.Vorkosigan]

The fact that you are asking this question means you are obviously guilty of something. The Thought Police are en route now. Resistance is Futile. I'd imagine that one of two things will happen: Either Oz.gov will ensure that their spyware app is overlooked by most commercial anti-spyware programs, or they will make it a criminal act to remove this application. Though I know nothing of Oz law so ???

You're command of inglish is ded.

[Anonymous Coward]

> its a dead document.

Your why Emericas schools ranks in the bottom of endustrialised nations: you cant spell & you cant punctate!!!11

MS Backdoors

[kentmartin]

If the Feds came to them and said, "You know, if you want to keep doing buisness, we need this from you,"

Heh - why would the feds have to bother? They are doing this already, unrequested, now we know why...

Modern???

[nebbian]

...so it's not like Australia's move towards normalizing law enforcement techniques to modern standards is anything new.

That's right, down there in little Australia they still use stone tools and hunt kangaroos with spears.
How is a shortsighted unworkable piece of legislation modern?

Re:Modern???

[UnpopularOpinion]

Wait... first tell us; why do you think it's shortsighted and unworkable?

Re:Modern???

[Anonymous Coward]

Well, would you agree to Orwellian? Or would I have to explain that to you too?

Re:Modern???

[UnpopularOpinion]

No, I wouldn't agree, actually.

No need for an explanation, but feel free to provide even the smallest amount of justification for your melodrama.

If a warrant wasn't required, then maybe you'd have a case.

Re:Modern???

[nebbian]

Shortsighted: Because the software is being installed on the consumers machine. There are a myriad of ways of detecting this, and I imagine a myriad of ways for this system to be faked into giving alibis and working against the government.
I don't imagine that it will be long before a "DetectGovKeylog.exe" program comes out, and the details of the protocol they use is made public so that you can send whatever misinformation you like to the police.

Phone tapping can work because the software/hardware is installed in the exchange.

Unworkable: Linux, MacOS, need I say more? Not everyone uses PC's you know. And if you're completely patched then there should be no way for the government to install these programs.

Re:Modern???

[SlayerofGods]

I think you are simultaneously underestimating the police and far overestimating your average criminal.
Think of this way, your average criminal is dumber then your average citizen... and your average citizen has spyware up the wazoo and doesn't even know it. I think the police can easly craft a spying program that will go unnoticed, maybe not by a slashdot reader, but your average criminal.

Re:Modern???

[rastos1]

It seems to me that most modern legislation is shortsighted and unworkable. It is modern because it is new. It is shortsighted and unworkable because ... OMG, if I knew that. Perhaps because there are no sane legislators to elect?

Re:Modern???

[the angry liberal]

I think you are simultaneously underestimating the police and far overestimating your average criminal.

Thank you for mentioning this fact. I would like to add to this by also mentioning if this is used in an investigation, the people investigating you will already know whether or not you are in IT. If you are, they will probably use whatever taps they can deploy at the ISP since it would be possible their bug would be found. If the investigators find you are a middle-aged woman who works at the grocery store and have no extended education, then it would be rather likely you would get the spyware tap to save time/money/warrants/etc over getting one at the ISP.

yet another reason to carry a Knoppix disc

[advocate_one]

and a usb keydrive with you to access your email with... gets round any spyware on the machines... unfortunately it can't cope with hardware based keyboard loggers or someone else in the circuit sniffing all your packages...

Re:yet another reason to carry a Knoppix disc

[codeconfused]

Excellent choice ! But I would go with slax.(smaller in size)and now that usb drives are getting big, 1 gig plus. You can carry all you would need. Better yet 1 of those tiny usb hard drives. Pricey but full of space for a full system.

Re:yet another reason to carry a Knoppix disc

[Yer Mom]

I would hope I'd notice if someone was sniffing my package...

ban guns, make it easier for criminals.

[poptones]

Violent crime in the US has been declining for more than a decade. It took a mighty downward trend during the administration of that oh-so-reviled Mr. Clinton.

Gee, do you think that could have anything to do with the assload of money that administration directed toward hiring new police officers? The timing cannot be mre coincidence: at the very time the Clinton administration's new measures were going into effect in 94/95 (Billions directed toward hiring thousands more police officers, a castrated assault weapons ban), violent crime numbers began taking a severe nosedive.

Was this due to the ban on guns? I doubt it given that "assault weapons" accounted for a tiny percentage of incidents in the first place.

Since shrub has been in office he has let the assault weapons ban lapse (whoopee) but has also been cutting all that money for police. And the years since "Mr tough on crime" took office represent the first time in years that violent crime numbers have NOT shown a consistent reduction, but are actually near levelling and showing an upward trend... all despite the presence of an attorney general who has also been one of the most outspoken in calling for even further reductions in our constitutional liberties. The assault weapons ban only recently lapsed, but the upswing in crime numbers began almost immediately after the administration (and policy) changes.

So rather than simply ask "what's wrong with the UK" I would also ask "what's wrong with the US?" Because the symptoms are the same, and it appears the UK is simply working toward becoming the next new US territory...

Re:ban guns, make it easier for criminals.

[LittleLebowskiUrbanA]

" a castrated assault weapons ban),"

What does tha thave to do with your point?

Re:ban guns, make it easier for criminals.

[Mspangler]

" the first time in years that violent crime numbers have NOT shown a consistent reduction, but are actually near levelling and showing an upward trend.."

Apparently not. On Yahoo news not 10 minutes ago was an article about violent crime going down suddenly, admittedly after a few years of increases. Crime up in recession, down as things pick up. No great new news here.

Re:ban guns, make it easier for criminals.

[hesiod]

This is not insightful, it's a corrolation != causation problem, even if they are vaguely related (though indirectly).

Another poster had it right on, but didn't emphasize it enough. Clinton's presidency had less crime because we were in the middle of an economic boom. If people have more money around, they are less likely to attack someone for it. After the boom levelled off & started going back to more reasonable numbers... then below... crime rates increased. Because there were fewer jobs and more unrest in the public.

exe != wiretap

[MacDork]

...it is in the same realm as a wire tap or bug.

Can a wiretap imitate your voice and say things incriminating? How about a bug? Spyware is an executing application that can do anything its author wants. It doesn't just listen, it can act. Just leave a port open and remotely execute arbitrary commands. Now you can frame anyone you want without leaving a trace. Not to worry though; It isn't like the police would plant evidence to get a conviction, right? You aussies just got totally screwed by the legislature.

Re:exe != wiretap

[Shadow Wrought]

Can a wiretap imitate your voice and say things incriminating? How about a bug?

Absolutely. At the end of the day they produce nothing more than voice recordings. People accept that and trust that there are controls in place to prevent Law Enforcement from manipulating them for nefarious purpose. The same would be true in tapping of a computer. If the prosecution has no way of verifying that the files found were not tampered with, then they will lose, and the technology will be refined until they can verify that no tampering was done.

This isn't to say that police have not tampered with evidence, nor that they will be immune from doing it in the future. But don't confuse stories here and there with an overarching conspiracy that everyone is in on. That's hollywood, not life.

Re:exe != wiretap

[MacDork]

If the prosecution has no way of verifying that the files found were not tampered with, then they will lose, and the technology will be refined until they can verify that no tampering was done.

Under your 'Do the right thing' scenario, the police will not only always lose, but they will render any computer evidence completely inadmissible by installing such a program. How can you determine if a file is created by police.exe or by the user behind the mouse and keyboard? There is absolutely no way to verify if the evidence is real or planted. Further, the prosecution won't care. Prosecuting lawyers don't care about being right. They care about winning. They will do everything in their power to hide the technical details, claiming they can't turn over info on the program itself for national security reasons or some other some other steaming pile of BS.

Have a look at the ridiculous crap they're using. The simple fact that it uses rot-13 should speak volumes. Oh and look at that: "open ip:port", "put filespec". Isn't that convenient. The average cop using this thing can't even figure out how to remove the bot's email address from the registry. Now suppose just one of those cops has a brain and a grudge, or perhaps h4x0r cop has no scruples and is looking for that big promotion. Whatever the case, you are screwed and the 'good guys' won't be any wiser. Why? You said it yourself:

People accept that and trust that there are controls in place to prevent Law Enforcement from manipulating them for nefarious purpose. The same would be true in tapping of a computer.

I'm not talking about a big evil conspiracy. Remove all the checks and balances and it only takes one bad apple. Without the full text of the law I can't be certain, but from the looks of it this is really bad news for Australia. Recording keystrokes is bad enough since it catches a lot of text you never actually save or send anywhere. Not specifically baring remote access and arbitrary code execution however removes any similarity to wiretapping/bugging and makes framing anyone a piece of cake.

Answer: poeple don't know about them

[cute-boy]

Our recently re-elected government in Australia is unstoppable at the moment. They ran a FUD (of terrorism, rising interest rates) and bribery (of the tv watching masses) campaign which go them a majority in both our house of representatives and our senate.

Minor parties did oppose these bills.

The laws are passed in such a way the general population either doesn't hear about then because they are lost in other bills. They are not covered by Rupuert Murdoch's popular news paper press or on commercial news networks, for the most part.

Quite often the direct effects are not apparent - these are the sorts of laws that creep up on you as they become used more frequently.

I think it's a dishonest goverment that introduces legislation by stealth. But sadly there are plenty of those around in this world.

The answer is to become polically active (which we still can).

Richard

Eh, well... sorta.

[Chmcginn]

You need to understand how anti-spyware software works. It doesn't automagically shield you from malware, nor does it inherently know what's a good program and what's a bad program. The reason you have to frequently update is because the human programmers do the grunt work of identifying malware and how to remove it, not the software itself.

It depends on how exactly their spyware functions. If it's a separate executable that communicates with their servers, a software firewall that's set to check your permission before allowing programs to transmit anything would stop it, regardless of how it was set up. That could still be circumvented by the government telling firewall makers to make an exception for their software, but that's not quite the same thing as telling them not to work around it, eh?

64-bit Knoppix, here I come!

[Anonymous Coward]

Just yet another reason to move to dvd-based fire-wall equipped leave-no-trace computing. Permanently. I only want a machine with NOTHING on the drive. Except while I'm offline, burning more copies. Run in ram, then shut it off.

Simple way to work around this

[AstroDrabb]

If your a crook, just _don't_ run MS Windows and this plan is shot. Run Mac OS, Linux, *BSD and your good to go. They say they are going to "monitor email, online chats, word processor and spreadsheets", which any knuckle-head crook can do very easily on Linux or Mac OS.

Is the govt. in Australia really this stupid? There going to waste tons of tax payer money, and any smart crook (the ones that are hard to catch), can work around this by switching OS!

Also, what about privacy issues? Or are they not important in Australia?

Re:Simple way to work around this

[taustin]

I think you're on to something. Obviously, using Linux will be a sign of criminal intent, so anyone who uses Linux would be a criminal.

And thus, Microsoft will conquer the world.

Re:Simple way to work around this

[fuzzybunny]

It's not an issue of privacy, it's an issue of control.

To stretch an analogy, this is similar to requiring individuals to show ID when boarding a plane, or to remove the shoes before doing the same. It does not safeguard against those with malicious intent, but it does establish precedent for more intrusive measures. Among these, as much as I hate to say it, is the idea that "if you're innocent, you have nothing to hide/fear."

I think a more relevant comparison would be one that is made with various proposals to embed black boxes in cars--it will someday probably be illegal to remove or tamper with them (or at least it will affect your insurance or the likes) and once an initial usage for nominally kosher law enforcement purposes has been set, a precedent exists for further nefarious abuse.

I don't hesitate for a moment to think that the legitimation of spyware on platforms of convenience (Windows/IE) creates a very convenient and dangerous basis, at least in the minds of some police/politicians, to mandate this sort of functionality in the future, no matter what you're using.

Similar to the UK RIP (regulation of investigatory powers) act, which, if I understand correctly, makes a crime of inability or refusal to surrender decryption keys for a given set of data to law enforcement, the dark future may bring ideas such as "you can run whatever OS/programs you want, but unless the police receive signal xyz from your computer, you are committing a crime."

Bleh.

Their new best friends...the US

[Anonymous Coward]

Bad time to be a Brit or Aussie. Both have governments that are in bed with Bush, and with Bush's policies, freedom is the first victim.

Good luck trying to make W happy. Until both countries are freedom free, Bush will keep the preasure on.

And as long as Bush can keep American's talking about Australia losing their freedoms, he knows Americans won't be talking about losing their own freedoms.

Keep the old head in the sand.

It legal to exploit a vulnerabilty?

[askegg]

I am a law abiding citizen of Australia and am shocked that our politicians could pass such a bill.

The law seems to make it legal for authorities to exploit vulnerabilities in an operating system to gain intelligence. What they fail to realize is it is trivial to remove their ability to install spyware.

Change operating systems (use Linux), stay behind a packet filtering firewall, use a secure browser, do not run as a user with install capabilities, use encrypted communications, use encryption technologies that do not require you to type in passwords (cards, biometrics, etc) - the list goes on.

It's a shame our government once again displays its lack of understanding regarding technology.

What I would do

[Anonymous Coward]

I would play along. Im sure with police and things if I said theres a bomb somewhere they would have to check to be sure, so you could talk a load of rubbish for a few weeks sending them around in circles!

solution

[Lawrence_Bird]

encrypted disk which requires cd or usb key to boot. I suppose they could then come up with a hardware device to snoop the pci or ide bus, but I'm sure additional workarounds can be made to avoid that too. And since they won't be able to install anything on your disk, you'll just have to remember to check your keyboard and connection everytime for any extra dongle! And close those blinds!

but I got antivirius

[sPaKr]

How is this going to work when I have antivirus software on my computer which is supposed to detect and stop exactly this stuff. Companies like symantec and mcaffe will have to buy in, and then Ill stop buying them. Spyware is spyware and a virus is a virus, even if the cops use it whats stops the bad guys from getting a copy and using it themselfs?

but i thought...

[Anonymous Coward]

in soviet australia, spyware installs you!

i thought that general world opinion was that KGB type monitering like this was a bad thing.

new legislation

[Anonymous Coward]

bit confused here, if you check here http://notes.nt.gov.au/dcm/legislat/legislat.nsf/0 /dc3235849078fff8692569cd00813843?OpenDocument they had a real ugly piece of legislation concerning surveillance in force already in 2000 covering them and New Zealand of all places . Read it, hair raising experience. So what's new here? BTW - used to be of neutral titling positive opinion of that country but the preponderance of evidence started moving me toward far more negative assessment recently. Those primitive British prison warden types that stayed seem to have gained the upper hand again!

Re:A Good Thing? errr maybe

[kurt555gs]

I can just see Johnny Law trying to get the spyware working on an RPM based Linux box.

Download spyware-0.9.RPM

User KPackage by clicking on the RPM icon

No way will the 5-0 boys use the commandline.

Next they will see:

Us-solved dependencies spybot-0.1.4.so

Mr. LEO at this point gives up.

Problem solved

Cheers

Techno-luddites

[Macgrrl]

Yet another good reason to be a Mac/OSX user, given they can't even get the Tax Office (to facilitate the taking of my hard earned money) to recognise a Mac, the chances of the AFP or ASIO tapping one are pretty slim.

Whoot

Beside, as we know from the movies, Mac users are always the good guys. :)

"possess any information"

[nurb432]

Guess that pretty much means any jr high chem student is in big trouble....

Re:"possess any information"

[myowntrueself]

Scientists and teachers in the UK should make their way to a government approved de-education center.

YRO?

[Anonymous Coward]

Shouldn't this be in the YRO section?
Probably not since it's here, nevertheless strange.

Re:A Good Thing? errr maybe

[Anonymous Coward]

Johnny Law: Now, let's get this thing installed...
"Now booting Windows ME..."
Johnny: Oh, we've been here already!

Sarcasm

[Anonymous Coward]

I am glad to see George Bush has been a positive influence on the rest of the world!

AC

Kangaroo Justice

[Anonymous Coward]

Looks like they will finally have the kangaroo courts they've sought for so long. Let's hope this spyware surveillance doesn't boomarang back in their faces.

"Is that a wallaby in your pouch or are you just happy to see me?"

Comment removed

[account_deleted]

Comment removed based on user account deletion

Sounds like...

[darkitecture]

Sounds like it's time for the not-so-paranoid to join the paranoid and really-god-damn-paranoid in using the Dead Man's Switch:

http://www.pcworld.com/downloads/file_description/ 0,fid,23183,00.asp

You set it so as if you don't login and reset the timer before a certain date/amount of time has elapsed, it will:

- Send an email out to people to warn them/tell them you're dead/imprisoned/abducted by that blind date

- Poo all over your sensitive files.

Awesome.

new code?

[sjrstory]

I wonder if they will build "higher quality" spyware that does now cause your system to slowdown and/or crash. Polymorphic features might be used to (attempt) to get around anti-spyware programs.

mirror for those not wanting to sign in blood

[Anonymous Coward]

heres a mirror mirror... (of the text at least..)

and knives!!

[themusicgod1]

good lord, my fellow british subjects! Why?

But?

[Anonymous Coward]

But will it affect service pack 2?

[Its a joke..!]

Ask mfr to add firmware?

[Mal-2]

Better yet, just put it in the network card... that market is totally cut-throat, so I'll bet that anyone who offered a network card manufacturer a large sale or two in exchange for some extra firmware... well...

Why bother?

1. Set up front company to buy network cards wholesale.
2. Open them, flash the firmware, re-package them.
3. Sell them really cheap to retailers and mid-level distributors. Give them to Dell for almost free.
4. Exploit hole.
5. PROFIT!!!

Or do the same with motherboards, since many people won't need a discrete PCI NIC, and most people never flash their BIOS. Point is, it doesn't require the assistance of the manufacturer to get compromised hardware in almost everyone's machine.

Mal-2

The silly answer

[dbIII]

It is when the due process bit is removed

No problem, we can filter out all traffic that doesn't have the due process bit set.

Addendum

[Capsaicin]

For completeness I ought to add that by virtue of s138(1) of the Evidence Act, the notion of unlawfully obtained evidence is captured by the term 'improperly obtained evidence.'

In other news...

[Kjella]

The UK populace, from now on referred to as 'sheep', have noticed no change.

UK politicans claim their jobs are a lot easier now that they don't have to deal with facts or anything.

The terrorist threat has effectively been eliminated as all the terrorists laughed themselves to death over the legislation.

In other words, they're happier all around. Of course, the rest of the world is tryingt to tell them they're crazy, but hey - that'd be knowledge. Ignorance is bliss.

Nope

[Kjella]

For all the DMCA does, it only protects content. You have just as much right to wipe spyware off your machine as you have to erase a DVD (you can't do that in software, but hey you could tear the damn data layer off the disk). There's no DMCA violation in that. Potentially, disassembling the spyware to look at its "insides" might be, deleting it isn't.

Kjella

Re:Nope

[StillNeedMoreCoffee]

Given a good government lawyer, if they have protections installed in their copyrighted software, and they have it legally installed on your machine because they have a warrant to put it there. They may be able to get you on the DMCA circumvention clause, kind of like they make it illegal to remove a Denver Boot from your car. Its your car right? and you have every right to delete anything off it right? Wrong. They would craft the law or the approach to the law that would make it illegal for you to do that. Remeber Al Capone got caught on Income Tax evasion and Clinton got caught for lying not for any improper behavior.

Re:Nope

[StillNeedMoreCoffee]

Not so, The DCMA protects protection of content with the anti circumvention clause. So it is illegal to take your DVD which you purchased, which is hardware and disable the protection mechanism that prevents copying or prevents viewing from another region. The goal is to protect the moneys to be made from the content to protect from you ability to use it when they think you should not. Even though it is your DVD player. I would think the Denver boot laws that make it illegal to pull thier boot off your car shows precedence for that type of trap within a trap that they are not only capable of but promote activily.

So if they can show with a warrant that they legally can have their software installed on your machine, and they have anti-circumvention code in that code, then they would first go to the anti-virus and anti spyware manufactures and silently get them to make an exception for their virus. This they can do. There was legislation at one point, it may not still be in effect, that prevented airlines from showing what part of an airline ticket was taxes. Doctors in certain government programs or accept government money are constrainted from talking about family planning options (by law).

The FBI has a technology to tap into the internet and look for illegal activity. The regularly approach ISP's to get their hardware inline with the ISP's feed so they can monitor the Internet. Some ISP's have refused to comply because, even with a warrent for survelance of an individual the technology listens in on everyone. With the Patriot act, they may be able to have easier access to those kinds of feeds.

Don't think for a moment that the DCMA only protects content. It protects the money to be made on content and in the protects the protection of content.

You right you can wipe spyware off your machine only because the makers of that spyware aren't taking you to court for DMCA violation. In this instance the government would certainly take any tack that is deemed necesary if it wanted a convictions, and with a warrent and a legal right to be on your machine they probably would and could prosecute.

How to get rid of AntiVir

[Morris Schneiderman]

I downloaded Antiviron onto an old, 300MHz laptop running W98SE, installed it non-resident, and ran it. It took close to an hour to scan 40,000+ files and reported no problems.

However, after that, it would take 'forever' (over a minute) to open a file by double-clicking on it. (Previously took several seconds.)

So I tried to use the Uninstaller included with AntiVir. Tried it twice. Both times it hung the system.

How can I get rid of AntiVir?

Thanks in advance,

Morris

Beautiful Mind

[riqnevala]

I am trained at firearms and explosives (in the army), so now I need to leave my head home while traveling?

Re:Beautiful Mind

[jc42]

Well, the US Homeland Security folks protect us from terrorists by banning fingernail clippers on airplanes. Your head is probably a lot more dangerous. Especially if you have a thick skull, since you could bang it against the pilot's head and knock him unconscious.

Remember the security folk's list of "something you know, something you have, something you are". Sounds like you've got them all covered with one head. But then, maybe the rest of us do, too.

A working head can be a dangerous thing.

Spin it, yeah!

[Anonymous Coward]

Only 30,000 federal warrants were request last year. Over 32 were denied.

The solution

[floki]

Australian Police Given Power To Use Spyware

Feeling discriminated? Just run IE, and the power of spyware be with you.

DetectGovKeylog.exe

[bergwitz]

I want this one now!

Purpose?

[TapeCutter]

Is this designed to catch Dr Evil or find out who that mixed up A/C guy is?

You insensitive clod... The UK hates science

[Anonymous Coward]

We are not taught cool stuff like that in the UK.

We are taught the theory to pass exams... that is all.

We don't even have Science Fairs :(

MS already made it

[usertrash]

Its called WinPE.

MS has had it around for a few years. Its nice because it drops you to a command prompt with admin access. I use it on a thumb drive to get onto my parents computer to fix it everytime they do something stupid.

The FBI almost certainly has a copy of this somewhere, even if they just had to go download it off Kazaa.

Nothing to hide? / Corrupt Coppers?

[victorhooi]

Just a copy of my osnews posts: Nothing to hide, eh? By Victor Hooi (IP: ---.nsw.bigpond.net.au) - Posted on 2004-12-14 20:16:14 Nothing to hide, eh? I'd be very suprised if you're not either ignorant or lying...(no offense meant). So you live a perfect life, you're a paragon of virtue and civic responsibility? Do you ever record free-to-air television (illegal) Do you ever borrow software from your friends? (illegal) Do you ever use mp3s? (illegal, depending on where you are - as a total of all mp3s, very few are totally 'legitimate' - plus the mp3 codec licensing) *All* of the software you have in your house is legitimate, I assume? If asked by police, you would be able to produce the EULAs and Proof of Authenticity, I assume. (and saying "it's a friends" is probably not good enough) Your power cords/power tools are certified by a licensed electrician every 6 months? (illegal if not - but most people don't - bloody ripoff) You have never made *any* modification to your phone line/mains without calling an Austel Licensed (I'm downunder) or licensed electrician? (illegal if not) Your plumbing is done by a licensed plumber, whom you ask to produce his documentation and license each time? Seriously mate, I very much doubt you have nothing to hide - they'll find something - and saying, "everyone does it" isn't exactly going to hold up in court - if they want to get *you* they'll get you for something. Bye, Victor ----Number Two Below------ Laycock.... By Victor Hooi (IP: ---.nsw.bigpond.net.au) - Posted on 2004-12-14 20:21:38 Sorry, another thing - what about corrrupt coppers? The son of the assistant police commisioner - Christopher Laycock - absolute corrupt, thick and true (he's confesed). He's intimidated witnesses, tapped phone lines, stolen police records, attempted to kidnap people using police equipment/help, beaten up and stolen from people etc. Then there was that Melbourne underworld scandal a few months back - apparently, people under witness protection were being shot/killed with inside help by police. Not very reassuring, that these are the people committed to protecting us - then we give them these rights. What's to stop another Laycock say, getting you're credit card number, or just obtaining private information and blackmailing you (anybody who's been following the court case will know he's *definitely* more than capable of doing that - kidnap, assault, robbery, etc, he's done them all - and he's the son of a assistant commisioner). Bye, Victor (I'm kinda lazy...hehehe)

wrong

[poptones]

There is direct correlation between more police officers in the field and lower crime.

The Reagan years were a boom time... crime was flat, didn't go down a bit. Shrub's daddy oversaw a relative boom during the gulf war (that he started) yet crime increased the entire time. In fact, it didn't even increase proportionately more after the (mild) boom ended, which further errs your attempted argument.

Crime continued to increase after clinton took office until the crime bill passed and all those police officers hit the streets.

Care to try again?

Covert hardware/software bugs easily preventable

[programmeratarms]

Just how difficult is it to set up a computer which will show evidence of tampering (particularly of the hardware kind)? Especially if your primary system is a laptop. Where exactly does one put a keyboard bug inside a laptop, with their famously non-interchangeable parts? It doesn't matter, really - glue the screwholes shut. Glue the hard drive in place. They can carry away your machine, but they cannot make it betray you and collect evidence. Use an open BIOS, with custom password prompt code. Now, none of this will stop the authorities from seizing your machine, and torturing the password out of you, etc.; but the undetectable planting of covert hardware/software bugs seems like a very preventable thing to me.