Security Researcher Faces Jail For Finding Bugs

An anonymous reader writes "French security researcher Guillaume Tena, who is working at Harvard University, faces 4 months in prison after being sued by Tegam for reverse engineering its Viguard antivirus software and publishing exploit codes for a number of vulnerabilities. According to a ZDNet article, he could also be sued by Tegam for 900,000 euros in damages. More details are available (in french) on Guillaume's website and on the K-OTik's website."

Comments

FYI

[daveschroeder]

Just to stave off any rants, this was not US law, a US court, or a US company. He happens to be working "at Harvard" now, but this matter has apparently been taken up in France.

Re:If I break in your car...

[dAzED1]

wah wah wah with the same old trite complaint. I'll give the same old trite response: apples, oranges. You own the car. With software, you only own the right to use one instance of it - right to use, not right to do whatever you want. Just like a radio station can't go buy a cd at a store and then play it over the airways - when you buy it at the store, you don't buy the rights to do anything and everything you want with it.

If you'd like a starter course on property law, someone else will have to give it to you.

Me, I truly believe information should be free, and only personal information (like, your bank account #'s, passcodes, etc) has any business being private. I'm a big supporter of all our little neo-communist mechanisms in the OSS movement. But really...don't get ownership of a car confused with ownership of software.

That USED to be true.

[jd]

Unfortunately, we had a terrible plague ravage the land, and its name was the DMCA. Terrible was its fury, as lo, a third of all programmers were laid waste, or at least laid off.

Under the DMCA, reverse engineering IS illegal. Specifically if it is meant to circumvent copy protection schemes, but in practice the "spirit of the law" could easily be presented as banning all reverse engineering of all kinds.

To make things worse, the click-through license usually also states that reverse-engineering is prohibited. The fact that the license's own legal status is iffy is unlikely to hold much sway in court.

Blogs...

[Kartoch]

For french readers and lovers of babelfish, this is two blogs about the case. One is from the defense of Guillermito, and the other from one of the viewers of the trial:

http://maitre.eolas.free.fr/journal/index.php?20 05 /01/05/37-affaire-guillermito-compte-rendu-daudien ce

http://bricablog.net/

Re:Here we go

[Anonymous Coward]

I have mod points, but I'll answer your question instead:

You have horribly simplified his actions of "helping someone" (releasing exploits aren't generally helpful to that company) and then described the company's actions ("greed") in an inflammatory way. The two legs of your argument are both flawed - so much so that it seems you are trolling.

The company's position

[Beryllium Sphere(tm)]

For anyone interested, just for the sake of presenting both sides, here is the Tegam response.

GOD FUCKING DAMNIT!

[Inthewire]

Moot.
Moot point.

Mute point my chapped ass.
Words fucking mean things.
God damn it.
Fuck.
Argh.

Seriously.

Ick.

Re:The French seem stuck in some Napoleonic fugue.

[louarnkoz]

Actually, the principle of free speech is written in the Declaration of the Rights of Man, published in August 1789 by the French National Assembly during the French Revolution. Article 11 states:

• La libre communication des pensées et des opinions est un des droits les plus précieux de l'Homme : tout Citoyen peut donc parler, écrire, imprimer librement, sauf à répondre à l'abus de cette liberté dans les cas déterminés par la Loi.

  The free communication of ideas and opinions is one of the most precious of the rights of man. Every citizen may, accordingly, speak, write, and print with freedom, but shall be responsible for such abuses of this freedom as shall be defined by law.

The declaration is perhaps the most important text of French politics, comparable to the US Declaration of Independance. It is incorporated in the preamble of the French Constitution, and as such is considered the basis for French laws.

Re:If I break in your car...

[AK Marc]

That's a condition of installing/using the software.

But not a condition of sale, and they won't let you return the software, thus, the EULA is not a legal contract.

Re:Here we go

[1u3hr]

Yes, but rather than pointing that mistake out to the company that produced the software, he pointed the mistake out to the world. I'm sure the company would have taken quite a difference stance on it had he let them know about it first before going public with it.

This was buggy anti-virus software. Users were at risk every day they kept using it. Unlike an OS, which people mostly just have to keep using till a patch is released, it's easy to replace this with something that works better, or at least not open files and attachments in the belief they've been checked and are safe.

Re:If I break in your car...

[Anonymous Coward]

Huh? Radio stations pay ASCAP and BMI fees. They can play anything they want. Believe me. I have my "Musician's Business and Legal Guide" sitting right here. This very copy is on sale on Amazon.com, if you're interested. I never made any money offa music, and it's too heavy to move to Japan.

Re:Poor phrasing

[Per Abrahamsen]

I don't know about France (or US), but in Danish law civil and criminal law is mixed up in two cases. The first is libel, and the other is copyright law. In both cases, private entitites can start a lawsuit with claim of prison sentenses.

That guy is simply sued for piracy

[Ray Alloc]

Apparently, that guy used an illegal copy of TEGAM's software and is sued for that reason. All the buz about a poor researcher is therefore off topic.