Slashdot Mirror
Tougher Hacking Laws Get Support in UK
rainbowhawk writes to tell us BBC News is reporting that new laws outlining harsher punishments for computer crimes are gaining support in the UK. From the article: "The move follows campaigning from Labour MP Tom Harris, whose ideas are now being adopted in the Police and Justice Bill. There will be a clearer outlawing of offenses like denial-of-service attacks in which systems are debilitated."
Laws against DDoSs. Great idea. Btw, let's next outlaw Hurricanes from destroying properties.
Yes, one is a man made problem, the other one a natural catastrophe (albeit some might argue whether man made it worse... not the topic now), the problem is the same. You can make the law, but you cannot execute it.
You want the bot-brain? Good luck. If he has half a brain, the controlling computer is not his, and it's sitting in some country ending in -stan. If he has no brain, all you accomplish is to execute Darwin's law: Survival of the best.
You want the bot-drones? Well, while this does have my full support, you can already hear the outcry from computer illiterates who fell for the marketing hype around the 'net and "how easy it is to get on", only to realize now that if they don't have a clue what their computer is really doing on the net, they're now with one foot in jail when they even go online. Can you see the Sun headline already? "Granny charged with computer crime!"
So, how is this going to do ANYTHING meaningful against DDoSs or other computer related crime?
In turn, what it accomplishes is that there will be fewer and fewer people with relevant skills. Let's face it, everyone, literally everyone, who is in the security biz today, from 'net security to virus analysis has some kind of record. Either a public one or (if he's good) at least one that didn't get public. But everyone has scratched and sniffed at a server or two. If you threaten new and intelligent people with jail time comparable with premediated severe bodily harm (up to 10 years sentence here), they will go out and find some less "dangerous" hobbies.
And the price for good security experts in the UK will rise. Either that, or you have to import them from some country ending in -stan, because there they can still learn the tricks of the trade.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
what will be illegal: possession or actual usage of them? cos technically speaking I'm in breach here simply for having several common utilities installed on this Ubuntu box. Tools I use to ensure my own systems are secure...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
And where will monstrosities such as Sony's rootkit fit into this? Surely our corporate overlords would be held just as accountable under these new laws as a poor 16 year old hacker in his parents' basement.
Buy Steampunk Clothing Online!
Does anyone else find it COMPLETELY wrong someone like Milan Babic (former Croatian Serb leader who just commited suicide) serves 13 years for genocide crimes and hackers can serve as much for a little denial of service attack?
Where does white stop and where does black begin? And, more important, do they care?
What they want is the perfectly safe and sane net. Which is by its very design impossible, the net itself is "dumb". It shuffles packets from A to B, not caring (too much) about their content. And that's its purpose.
Their idea seems to be that, if there is nobody who CAN hack, nobody DOES hack. But that's the same theory you can apply to guns. What happens if you outlaw guns?
Exactly.
The best defense against an attack is to have the better guns. Or, in terms of the 'net, the better hackers. If you outlaw them, if you outlaw learning the techniques and the tricks, which you pretty much do when you outlaw hacking altogether, since even a page about hacking can be labeled a "hacking tool", you do the equivalent of outlawing weapon development in your country.
And what happens when you do but other countries don't?
Exactly.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This is one of those laws written by people with no clue about technology, and therefore hopelessly and dangerously broad. In this case, the text reads:
A loose but credible reading of the above seems to cover every mainstream operating system, every compiler or interpreter, every text editor, every communications tool, and more.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Where's the moderation, "+1 Scary, but true.." when you need it?
Babic killed people. Hackers kill shareholder values.
Wrong?
From a moral point of view, yes.
From a human point of view, yes.
From a personal point of view, YES.
From a financial point of view, no.
You got 3 tries to guess which one counts.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I'd be more worried about he does any unauthorised act in relation to a computer
This essentially makes British law inclusive, which is very bad . Instead of prohibiting a set of actions, it now appears okay to simply list what is okay, and assume blanket illegality for anything else.
...what about cracking?
Protect your browser with the Force Safe Search add-on
There will always be people who will try to break into systems, but if the software is hardened to a certain extent then maybe the scr1pt k1dd13s will be kept out
You can harden Windows to a stage where it is very difficult to break into; equally, you can deploy UNIX, VMS and AIX in a fashion that is very open. The fact that someone uses something with insufficient knowledge to do so properly can not be blamed entirely on the manufacturer. If they knowingly and negligently allowed it to be released with unfixed flaws then yes it would be wrong, if they made errors in production that they then fixed you can not blame them for that.
Take a real world example of a car that is produced with a faulty seatbelt and airbag combo. If the manufacturer was selling knowing that it was unsafe then it is wrong. If they sold it, realized the problem and then recalled all the effected models to fix them, without charge there is not problem. You could not them blame them for someone driving the car into a cement wall and not surviving. Why then do we think it is Microsoft's fault when some idiot puts an un-patched NT 4 box on the internet and it is compromised in short order?
The only reason some people get lost in thought is because it's unfamiliar territory.
This law is designed to make more people criminals. They can't examine an innocent person's computer, but if you're unwittingly breaking an arcane law, suddenly you're a criminal and the police can investigate all they like.
Prosperity is only an instrument to be used, not a deity to be worshipped. Calvin Coolidge
The problem at least in the UK is that this act, if passed into law, is unlikely to be used against the professionals or the mythical Mr Big. They will continue as before from their foreign havens while some luckless amateur sadsack in a bedsit is busted to headlines and mucho self-satisfaction from the cops.
Things are only likely to change - anywhere - when a) there are more politicians who can tell a computer from a tennis racket, and b) the cost of computer crime is forcibly brought home to the politicians to the point where they will start hitting the safe havens with trade sanctions and the like. At the moment, much of that cost isn't above the surface, I would guess. Companies are reluctant to fess up les it reflect on them and computer crime is accorded a low priority compared to the various "wars" we are all meant to be fighting in these exciting, high-pressure times - the war on terror, the war on drugs, the war on yobs, the war on binge-drinking, the war on obesity, etc., etc. Just my 2 cents, but I can't see computer crime receding till the present generation of politicians has retired or (some might hope) been locked up.
Las qué passoun
tournoun pas maï
On top of that there are a lot of things that might be considered hacking tools that have very valid uses. For example nmap or ethereal can be very useful for network analyis, but are often used to portscan or packet sniff without permission too. I think that having a penalty for 'hacking tools' is silly.I t would be like penalizing people for using knifes in kitchens because you can also use a knive to stab someone.