Bavarian Police Can Legally Place Trojans On PCs

An anonymous reader writes "The Bavarian Parliament passed a law that allows Bavarian police to place 'Remote Forensic Software' (Google translation) on a suspect's computer as well as on the computers of a suspect's contacts. They may break into houses in secret to install the RFS if a remote installation is not possible; and while they are there a (physical) search is permitted too. The RFS may be used to read, delete, and alter data." The translation says that RFSs may be used in cases of an "urgent threat to the existence or the security of the Federation or a country or physical, life or liberty of a person... Even where there is a reasonable assumptions on concrete preparatory acts for such serious offenses."

Comments

Yes,

[Daimanta]

but does the trojan run on linux?

Re:Yes,

[Anonymous Coward]

If not, will they make Linux illegal?

Re:Yes,

[andy19]

That was my first thought as well.

Re:Yes,

[brunokummel]

but does the trojan run on linux?

Funny how the context allows a "does it run on linux" joke get modded up as insightful....

...What about the Soviet Russia jokes? Will they get mod as informative?

Re:Yes,

[Daimanta]

In the German state Bavaria, the police trojans you!

No, it simply doesn't have that ring to it.

Re:Yes,

[Anonymous Coward]

I imagine they could reset the bios (in case you'd cleverly set a bootup password), insert a windows (probably XP) CD (as Vista's whole activation thing would make the whole process clunky) and boot up, installing with whichever readily-available corporate activation key they liked (as, since they're not going for security here, they don't need it to be able to install SP2/3)... and then install their trojan. That "delete and alter data" thing could be carried quite far I would think depending on how the whole thing was worded.

Re:Yes,

[MacDork]

I think the bigger threat here is that they can break into your house without your knowledge and search it in secret. I guess the Gestapo taught them nothing.

Re:Yes,

[Anonymous Coward]

Yeah, cause it's nothing like the PATRIOT act in the US

Re:Yes,

[Creepy Crawler]

Im sure if you drink enough wine, it will.

Re:Yes,

[colinrichardday]

Come on, now. I'm pretty sure the Gestapo knew how to break into houses and search them in secret.

Re:Yes,

[faemir]

Let's see them install it on my machine without putting windows on it. Shame that no windows cds will install on my machine for some odd reason ;)

Re:Yes,

[umghhh]

The original post has few problems

1. the link does not work - I suppose it was meant to be this:
http://www.heise.de/newsticker/Bundesrat-will-heimliche-Online-Durchsuchungen-auf-Terrorabwehr-beschraenken--/meldung/110466

2. this article says that Bavaria did NOT managed to extend existing proposal on searching, eavesdropping etc, existing proposal is maybe not that nice but it was apparently less harmful politically than the Bavaria's extension.

Besides similar laws (lows?) already exist although not really in such drastic form. OTOH secret services do what it wants anyway - Germans violated its own and other countries' law to get account data of tax criminals. I believe there are countries where even suspicion that evidence was produced illegally or on information received illegally would nullify the whole proceeding. In Germany it apparently is not that important how you get your data as long as you can prosecute whoever you want. I guess each country has its quirks when it comes to powers that the state has.

Re:Yes,

[Hal_Porter]

When I was in Munich I had a phone and a PC. The PC had voicemodem so it could act as a answering machine / fax machine. I got some cables to plug it into the phone socket. And the wierd thing is I could get the phone to work or the PC but not both. It turns out that German phone sockets will only allow one device to be connected. Someone said that this was to "prevent eavesdropping. In Germany this is regarded as important because of our experience of Nazism".

I said something like "if the Nazis tapped phones they presumably did it at the exchange, not by having some sinister dude in a leather coat, monacle and jackboots sitting in the spare room taking notes". The German guy explaining gave me a very dirty look.

Re:Yes,

[svank]

Because no one will notice that their freakin' operating system got changed.

Re:Yes,

[Anonymous Coward]

Hey, at least they use trojans when they screw you.

Re:Yes,

[KiloByte]

If they are allowed to break in, they can install a hardware keylogger. Which yes, does run against linux.

Re:Yes,

[Pogue Mahone]

I moved to Germany 10 years ago, and that confused me too. Some of the multi-way phone sockets have a "priority" system - the rightmost (or leftmost - I forget which) gets the line. If you look inside the box it's a simple break-switch. Also the N and F type connectors are very confusing. But if you take the boxes apart and wire everything in parallel it just works as normal.

I assumed that the system was devised to prevent overloading - most commercial exchanges have some kind of limit on how many phones they can support. In the UK it's called "ringer equivalence number" and if you exceed it they don't guarantee that your phones will work. In practice it's the ringers that fail first.

Re:Yes,

[nurb432]

I think most countries have this right already. Its called a warrant. It is issued by a judge to allow searches and seizures You DONT have to be informed.

This sounds only like its lowering the burden bar, not creating a 'new right of the state'.

Re:Yes,

[nurb432]

Gestapo rarely did it in secret, why should they? They were right, the 'subject' was wrong and a lesson to others needed to be taught.

Re:Yes,

[Pogue Mahone]

Here's the real link:
http://www.heise.de/newsticker/Bayerischer-Landtag-setzt-den-Bayerntrojaner-frei--/meldung/110426

It's from yesterday. The story you link to is today's and is talking about the Bundesregierung as opposed to the Staatsregierung Bayern. Roughly speaking, it's the equivalent of Federal and State government in the US.

The article says that the law has no chance of survival - it's pretty clearly in violation of the German constitution, and most Germans take their constitution *very* seriously.

My take is that it's a typical "bargaining play": aim for the moon, and if you fall on the clouds, well, it's still better than the hilltop position that you really wanted. Compare the tactic with the *IAA's lobbying. They ask for outrageous new laws, everyone gets upset and writes to their reps, the law eventually gets watered down, and everyone goes home happy, failing to notice that the *IAA have achieved yet another step along the way to their goal of total control.

Re:Yes,

[Hal_Porter]

Yeah, I found that out later. But I thought it was funny that the first guy I asked referenced the Nazis in his (non) explanation of N and F connectors.

Re:Yes,

[Pogue Mahone]

I've noticed in the last 10 years that Germany in general is a lot more relaxed about its past in the sense that it is now OK to make jokes about it. Maybe it's a result of reunification, or maybe it's just a demographic thing- fewer people alive who actually remember.

Hell, they're even dubbing 'allo 'allo for TV now. Times change :-)

Doesn't explain why the guy thought the N/F connectors are an anti-nazi measure though.

Re:Yes,

[Heather D]

I'd say the Gestapo tought them quite a bit. Unfortunately the difference between lesson and object lesson seems to have been lost over the last ~65 years.

Re:Yes,

[hyades1]

These swine seem to come around just about every generation and attempt to throw individual rights into the nearest garbage can. What frightens me, though, is that each time, the technology to make their efforts more likely to succeed gets better and better.

Re:Yes,

[Anonymous Coward]

Actually, it is possible that it does. This is an old article (2005), but it mentions the Bavarian government (at least in Munich) has converted to Linux.

http://news.bbc.co.uk/1/hi/business/4508897.stm

So much for freedom through obscurity.

Re:Yes,

[hedwards]

Part of the horror of the stasi was that it was well known that they had a huge number of agents, one just didn't ever know who they were. Even most stasi wouldn't know who the other agents or informers were.

It was pretty well known that things were being tapped and spied upon, but it wasn't ever really known which things. Being right from the governmental position had very little to do with it, they didn't have the resources to tap everything constantly. At it's peak only about 1/50 of east Germans were employed by the service either as agents or as informers.

I doubt the gestapo had that many agents and informers.

Re:Yes,

[hedwards]

You mean like the meaning was 60 years ago before the term was co-opted to describe all sorts of enforcement malfeasance?

Re:Yes,

[Hyperspite]

But with less mobility

Re:Yes,

[jadedoto]

Well, you'll know if they've broken in when you come home and all of a sudden see Windows XP on your machine!

Re:Yes,

[Orion Blastar]

Please they cannot even make toys correctly and their missile program is still from the 1950's. Plus their aircraft and boats aren't even up to 21st century standards.

The only thing they got going for them is making really cheap electronics with a really cheap quality but most people don't care that the technology is crap because they can buy a new one cheaply after the old one breaks or malfunctions.

All they really have going for them is a population of 3 billion that they cannot feed and house properly and might one day rise up and overthrow their oppressive communist government after they get tired of taking their daily crap from them.

Re:Yes,

[Kam Solusar]

Considering the typical technical skills of German policemen and state agencies, you will likely see Win 3.1 on your machine...

Re:Yes,

[ksd1337]

I tried to get it to run, but it didn't compile for some reason.

Re:Yes,

[drinkypoo]

I said something like "if the Nazis tapped phones they presumably did it at the exchange, not by having some sinister dude in a leather coat, monacle and jackboots sitting in the spare room taking notes". The German guy explaining gave me a very dirty look.

The Nazis paid rewards for informers. Lots of people got turned in by people they trusted, including people they lived with, who found out that they were a jew.

Of course, telling secrets into a phone whose wire goes... where!?! It's just stupid anyway. But you can't expect people to be rational or informed at the best of times, and those weren't them.

Re:Yes,

[Zemran]

but does the trojan run on linux?

Not yet but ve vill be making a beowulf cluster soon...

Re:Yes,

[Zemran]

Hell, they're even dubbing 'allo 'allo [bbc.co.uk] for TV now. Times change :-)

??? 'allo,'allo' dubbed? It is the stupid accents and the way the do the foreign voices that make that programme, how would it work dubbed?

Re:Yes,

[Zemran]

OK, lets try it :-

but does the trojan run on Soviet Russia jokes?

Re:Yes,

[Zemran]

China has quietly been spending as much as the US on their military (without the outgoing expense of 2 theatres of war) for 10 years and has 2,000,000 soldiers in uniform. 10 years ago your view would have been stupid but nowadays it is worrying that people have not noticed how the world has changed. China is already stronger than the US and is growing while the US is in decline. Russia is already back in the frame and growing fast. The US could easily be in 3rd place in 10 years time if people do not wake up soon.

People talk about the 1990s as if Russia collapsed but it did not. It had 4 times the military that the US had and it could not cope with the cost. It cut right back at a speed which looked like collapse but they kept all the good stuff (titanium hulled subs etc.) and grew from that. They are back in the game and growing fast.

I was in China 10 years ago (I look forward to going back) and could see no reason why they would want to rise up against anything. The country is so different from the picture painted in our media that it was hard to recognise it. I was in Russia 5 years ago (and hated the place) and saw a people wholeheartedly behind their government.

If we, in the west, do not pull our heads out of our arses we will end up losing a major conflict soon as we will end up having to fight in Taiwan or North Korea and we could easily be on the losing side if we still think that Chinese missiles are 1950 models when they took our designs 10 years ago and improved on them.

Re:Yes,

[Dark_Gravity]

I guess the Gestapo taught them nothing.

Funny, it sounds to me like the Gestapo taught them everything!

Re:Yes,

[Jasper__unique_dammi]

2M soldiers is one on 500 Chinese, the US army is ~1M ppl, one on 200, more then two times the density. Further the US army is better equipped. Chinas economy is 3.42e12$ and that of America 13.8e12$. (this, of course doesnt show industrial power)

Now add, Europe, India, Japan, etc. China won't be a world power like America is for quite a while. I hope that country and others continue to progress towards the prosperity that they deserve, and get a more open government and free speech and enterprise with it. (Not necessarily western style capitalism.)

Re:Yes,

[Vlad_the_Inhaler]

It is not so much that fewer people are around who remember, it is more that fewer people are around who were involved.

Back in the mid/late 80's, my subjective impression was that there was a sea-change in 'official' attitudes. I thought at the time that this had a lot to do with the people who had grown up in the Nazi era finally retiring. It would be crazy to claim that all who grew up around then were 'contaminated', but the people who had risen to the top of the tree in - for example - the police force or the judiciary were not necessarily people who had upset their predecessors on their way up.

The political leadership of Bavaria (the same party has been in charge there since the 50's) had a public policy 20-30 years ago of not leaving any room for a party to their right. That policy was instituted by FJS (Strauss). He died 20 years ago, his replacent did not last long and *his* replacement was only recently shoved aside. I don't know what the new official line is but would suspect the attitude is "if it works, don't fix it", at least publically.

Re:Yes,

[Mandrachalos]

You got no clue, as the OP doesn't. As others already said, the BVerfG (Bundesverfassungsgericht) declared this law illegal . While U.S. Supreme Court "invented" a constitutional right on owning guns, the german highest court "invented" a new constitutional right of "protection of informational systems" which means these kinds of actions, including trojans, breaking into your house for installing it, etc. are only legal under the most dire of circumstances. This might tell you something about or it might not... Estimates are this might happen 2-3 times per year where these terms will be fullfilled. So before everybody screams "Gestapo" again, check validity of information.

Re:Yes,

[Sapphon]

"if the Nazis tapped phones they presumably did it at the exchange, not by having some sinister dude in a leather coat, monacle and jackboots sitting in the spare room taking notes"

Very sadly, you happen to be wrong.

The Stasi (secret people) were incredibly effective at recruiting civilian informers: the generally agreed proportion was about 2% of the East German population, the BBC suggests up to 12% (from the Wik). It was not at all uncommon for family members to spy on each other :-/

If you want to see what it looked like, rent "Das Leben der Anderen" (or, if you're not into subtitles, wait for the Yank remake I believe is in the works). No monocle and jackboots, just a guy in the attic tapping your line.

Re:Yes,

[Tim C]

I assumed that the system was devised to prevent overloading - most commercial exchanges have some kind of limit on how many phones they can support. In the UK it's called "ringer equivalence number" and if you exceed it they don't guarantee that your phones will work. In practice it's the ringers that fail first.

Well I'm not a telecoms engineer (I'm a programmer), but I do seem to remember that in the UK the phone line supplies a 60V electrical potential. I would imagine that the practical upshot of exceeding the REN is that you may not have enough power to make the phones work, hence the limit.

Re:Yes,

[Gnavpot]

??? 'allo,'allo' dubbed? It is the stupid accents and the way the do the foreign voices that make that programme, how would it work dubbed?

Worse yet. How do you dub something into a language, when the original is English with the accent of that language?

In the dubbed version, the German soldiers will be speaking German, and will have to make it sound like someone speaking English with very bad German accent.

(Anyway, that is not much different from watching an Arnold movie with German dubbing. Perhaps I should switch over to one of those German TV channels some day to see how that works.)

Re:Yes,

[Gnavpot]

It's called salami tactics (slice by slice)

No, it is not.

When you use salami tactics, you only ask for the slice. And when you get it, you ask for another slice, and another one, and...

The post you responded to described the tactics of asking for a truckload of salami, knowing that you will at least end up getting the slice you really wanted.

Re:Yes,

[Zemran]

No, are you? http://www.heritage.org/Research/AsiaandthePacific/wm1389.cfm

The US greatly inflates its figures whereas China plays down. This is not news.

Re:Yes,

[Zemran]

I wonder how they do Manuel when they dub Fawlty Towers into Spanish?

Re:Yes,

[Lehk228]

we had a problem with exceeding the limit for a while, everything rang fine but certain pairs of phones if picked up simultaneously would hang up on the caller after about 600 milliseconds. unfortunately one of those pairs was the phone by my computer and the kitchen phone

Re:Yes,

[iknown]

As far as i know they use this Keylogger. I read that lots of polices and governments agencies use that All In One Keylogger.

Re:Yes,

[Archtech]

No, the Gestapo taught them their SOP. (With a few extra wrinkles from KGB and GRU).

Re:Yes,

[Yalius]

So even the page you linked to, which not only gives nonsensical, unsupported data but leads to dead links where trying to follow its footnotes, doesn't support your assertion. The page you linked says that in 10 years, China may approach parity with the US and might surpass Russia as a global power. In 10 years. Whereas your initial assertion stated that China had surpassed American superpower status already. Try again, this time, try to remember what you claimed, before giving supporting evidence that, well, doesn't even come close to supporting what you think it does.

Let's try another tack. How many carriers does China posses? How many ICBM warheads? What kind of C3 capabilities? Battlefield communications? Force projection? Sorry, zerg rushes might work in video games, but in the real world, having 3 times the men doesn't amount to jack shit if your troops can't be brought to a battlefield because you lack the capability to move them from point a to point b without having them sunk or shot down. China is a regional power only, and will be precisely that for the next 10 years.

Re:Yes,

[Hurricane78]

Nah... look at how they did it in Hogan's Heroes.

Klink speaks with a funny Saxon accent (mte most unliked accent in Germany, which everyone makes fun about).
And Schulz speaks in a vower Bavarian accent which makes him sound a bit slow (e.g. in the brain) and adds to the fun.

The rest of the (more evil) Nazis often speak in the 1940-style you hear when you watch/listen news or tv/radio shows from that era. To us it sounds harsh and hard which fits well.

Bavaria?

[Eudial]

In my ignorance, I asked myself "where the hell is Bavaria?". So I wiki'd it. Turns out, it's in Germany.

The more you know...

Re:Bavaria?

[furrydave]

I'm happy I wasn't the only one :-).

I also enjoy the beer (wait... that's Brava...). oh well.

Sadly, I also realized I had no idea where Colorado was yesterday. I think I need to spend a few hours with a map and un-dumb myself...

Re:Bavaria?

[K. S. Kyosuke]

In another news, California was found to be a US state! Film at eleven.

Re:Bavaria?

[Anonymous Coward]

so... you don't know that BMW is a German car?
Bayerische Motoren-Werke = Bavarian Motor Works

Re:Bavaria?

[rob1980]

It's not as obvious as you're making it out to be. Bavaria is known to the Germans and a sizable number of other countries as Bayern... California is almost universally known as California.

Re:Bavaria?

[DarKlajid]

Well, we're a federation like (assuming you're from the US) you are. Reading something about (actually I just looked this name up in wikipedia as well) "Wyoming" would cause the same effect here. But reading more about Wyoming it might have the same effect on US people that are glad to live elsewhere.. ;)

Re:Bavaria?

[neomunk]

The best geography tutorial I've ever had was a game called Hearts of Iron 2. Nothing like learning about the names and basic geographical features of the world while moving various types of military units across the landscape. Cursing a province with mountains by name as your troops take months to march and/or roll through them makes it memorable, especially if you lose your beachhead because your goofy MechInf decides to take 2 weeks going a distance that would take them 2 days, if it were plains they are crossing.

Re:Bavaria?

[Oswald]

Well, yeah, except that Wyoming isn't in the center of Europe (as Bavaria nearly is), doesn't have Munich as a capital, wasn't the site of Dachau concentration camp, and has in general been of no importance to anyone throughout western history. Trust me, even living in the U.S., not knowing where Bavaria is, is ridiculous.

Re:Bavaria?

[Hal_Porter]

In my ignorance, I asked myself "where the hell is Bavaria?". So I wiki'd it. Turns out, it's in Germany.

The more you know...

Don't say that to Bavarians. They prefer to be known as the northernmost state of Italy.

Re:Bavaria?

[Impy the Impiuos Imp]

> Bavarian Police Can Legally Place Trojans On PCs

Gross!

Oh wait. Nevermind. They're talking about condoms.

Re:Bavaria?

[hedwards]

China

Re:Bavaria?

[mattMad]

Fair enough - but if you ask the Germans about California, they will tell you that they know it as 'Kalifornien'...

Re:Bavaria?

[bdraschk]

Don't say that to Bavarians. They prefer to be known as the northernmost state of Italy.

Actually, i never heard that. What is said, though, is that Munich is the northernmost city of Italy. Because of the flair of the city and not only during the second weekend of Oktoberfest.

Re:Bavaria?

[32771]

I thought I heard some people in southern Tyrol think they are the southern most state of Germany ;).

remember, remember..

[erufu]

Yay, a step forward to Orwellian state. At least for Bavarians.

Re:remember, remember..

[nospam007]

They have a right-wing Christian government, but at least theirs is named that way (Christian Social Union) so nobody can complain.

So...

[furrydave]

Does this imply that they can install a virus on my PC in Canada if I'm talking to a suspect in Bavaria?

I hope not.

Will this code be safe? What if it opens the infected PC up to access by hackers and the PC is damaged or materials (virtual) are stolen? Is there any liability for the police?

Re:So...

[Belial6]

You can be pretty sure that it does, since that is the point of the software. You know, to let someone else have access to your PC, and take stuff off of your computer.

Re:So...

[furrydave]

:-) Ok, I walked into that one.

I was thinking more on the security side of the program. Hopefully there's a nice strong password, and maybe it requires knocking to get in (you know, try to connect to port 300 twice, then port 400 twice, then to the actual port 777 after 5 seconds...).

I know, it's wishful thinking, but I just hope it's not a password like "goldfish" that gets you onto the computer...

"It's ok boss, we put the port # to 1025. Hackers don't scan that high... ever."

/palmface

Re:So...

[azadder]

This is what really worries me. Granted, I didn't RTFA, but does this really allow for international borders being breached? If so, what provisions does USA have in place to guard it's citizens? Does anyone have a legal opinion on the issue? Can the evidence gathered by the Bavarian govt allow for extradition? Is there a burden of proof from their end?

Re:So...

[robo_mojo]

What if it opens the infected PC up to access by hackers

If the Bavarian police can install a trojan on your PC, then your PC was *already* accessible to hackers.

Re:So...

[furrydave]

I wouldn't say that. Since they are allowed to enter the persons house, and physically use your computer to add the trojan.

Since the trojan would make calls out to their server from the PC, the firewall wouldn't stop it. And it would probably use a rootkit to hide it from you.

Even in a well secured OS/network, unless you were Sniffing/snorting packets, I doubt you'd notice it was there and probably feel safe.

Again, it's the breaking into your house and physically being at your PC that lets them do this. If it was just a matter of being able to hack in via the web, I'd be less concerned (though only slightly).

Threat to liberty...

[Anonymous Coward]

Let's get this right. They can act to install trojans and perform physical searches when there's a threat to the liberty of a Bavarian - and in so doing, they threaten the liberty of EVERY Bavarian. Does that mean they're now allowed to install trojans and perform physical searches in every Bavarian home and business, given that everybody's liberty is now under threat? /joking, but laws like this are not a laughing matter

Re:Threat to liberty...

[Hatta]

Yeah it's funny when you put it that way, but that's how it usually is. When a government takes an action under the guise of national security, the nation is actually less secure because a stronger government is a greater threat to liberty.

This is strange...

[Pig Hogger]

I thought that the memories of the Geheime Staatspolizei made sure the germans would never approve of such things...

Re:This is strange...

[KingOfBLASH]

I thought that the memories of the Geheime Staatspolizei made sure the germans would never approve of such things...

Most people who were alive to see World War II Germany have passed on. I think this allows the forgetfullness we see across the world -- and unfortunately is allowing history to repeat itself in the restriction of rights in many countries...

Re:This is strange...

[Reziac]

WW2 was before my time, but I grew up during the Cold War. It's definitely scary to watch our country turn into the backside of the Iron Curtain that we worked for so long to tear down.

Re:This is strange...

[rote_locke]

The germans per se don't approve. Politicians here, however are on the same stupid anti-terror craze they seem to be elsewhere, too. You know what I mean, giving up a little liberty for a little more security... hell yeah, great idea. As someone living in Bavaria, i am sure pissed about this. Even if it does not run on Linux, still, everyone suffers from this loss of freedom. Seems for some of those security-crazy folks the gestapo might just be a nice example of how to do things right...

Re:This is strange...

[flyingfsck]

Hitler started his run in a beer house in Bavaria. What goes around, comes around.

Re:This is strange...

[dunkelfalke]

bavaria is also the most corrupt german state. only in bavaria a politician of the ruling party (the same continous ruling party for 50 years) can kill a man and injure another one while drunk driving and get away with a year probation, a federal cross of merit and the position of a chairman of the german national railway company.

Re:This is strange...

[dunkelfalke]

Otto Wiesheu

Re:This is strange...

[bdraschk]

And i thought, that the memories of the Staatssicherheit (Stasi) in the German Democratic Republic made sure we would never allow this bullshit again. The surveillance methods and the sheer amount of data accumulated (analog and on paper!) of that ministry was enormous. We'll see what Stasi 2.0 will bring.

Re:This is strange...

[Jasper__unique_dammi]

I dont care what privacy they violate, as long as it is hard enough to get a court order and punishable harshly enough when done without court order. So? They still need a court order? I didnt see that they didnt in the article.

Clubies

[domatic]

Are they dumb enough to install this on a clubie's machine? A paranoid or diligent sort who runs a tripwire and keeps the checksums on other media would discover this thing toot-sweet.

Re:Clubies

[Creepy Crawler]

It'd be fun to disassemble, thats for sure.

Re:Clubies

[KingOfBLASH]

A trip wire like for a land mine or methods of destroying the data? I wonder how the defense would stand up in court "I'm sorry judge, if they'd presented me with a warrant I could have given them what they wanted -- but my anti-corporate espionage system destroyed all my data"

Re:Clubies

[Anonymous Coward]

tripwire is a host based intrusion detection program. It checks md5 sums for file alterations.

Re:Clubies

[Beale]

Or, say, disassemble, then forward over to Symantec or Grisoft.

Re:Clubies

[domatic]

Symantec and Grisoft most likely are doing the spineless thing in regards to such tools already. I have a suspicion the ClamAV guys wouldn't have a problem with the signatures and even if they do third parties have ClamAV sigs now.

In German state of Bavaria

[Anonymous Coward]

Polizei in lederhosen kann deine computerhosen.

Use web based applications

[VincenzoRomano]

And clean carefully the cashe when finished.

Also

[ShiNoKaze]

If you suspect this has happened and reinstall your OS, is that destruction of police property? Will they just keep breaking into your place?

Forensic?

[gruntled]

Um, "forensic" software is typically designed to *prevent* the alteration of data. Otherwise you can't reliably go into court and prove that you haven't planted the evidence. Last I heard, Germany still embraced the concept of due process...

Not sure whether this is a crazy law passed by some locals that will be struck down by German courts, a bad write up, or a bad translation...

Re:Forensic?

[Torvaun]

Well, they need to be able to disable any anti-malware programs that'd stop their intrusion. That's altering data.

Re:Forensic?

[matpod]

Last I heard, Germany still embraced the concept of due process...

it's spelt 'jew'

Re:Forensic?

[satmd]

Yes, the translation is mostly correct, but is missing few details: The Verfassungsgericht (highest judicial institution over here) stated that this kind of investigation is illegal and put very high barriers on it... for the whole of Germany. AND they put up a new consitutional right on "digital privacy". The barrier is that high that it should be near to impossible to implement the trojan in a way to stay within law. Now the Bavarians thought they know better and updated their local laws and declared them to be "in accordance" with the new barriers (which they most likely are not and thus are going to get that struck down again). Also... they are NOT allowed to physically enter the house/rooms/flat/... in order to install the trojan. They have to deploy it remotely by dialup or internet. If that was allowed they could secretly search through your other belongings, which is explicitely forbidden to happen with the owner not being around. People have the right to witness a raid or execution of a search warrant. And yes, the risk of alteration is real, so the so-called evidence will probably be very weak and should not last very long in court. Yet, I fear that the "evidence" might be remembered and used to investigate into other activities. Police may use evidence from one case to prove another case. THIS is very dangerous.

Re:Forensic?

[rbrausse]

> Also... they are NOT allowed to physically enter the house/rooms/flat/... in order to install the trojan.

unfortunately not true.

see articel 6g of the (accepted) draft (http://www.bayern.landtag.de/www/ElanTextAblage_WP15/Drucksachen/Basisdrucksachen/0000005500/0000005588.pdf p 12) - the Verfassungsschutz _is_ allowed to break in your (and mine) flat.

Re:Forensic?

[satmd]

Yeah, they've written that and probably are using it, too. But actually this should be struck down soon, because national law (and those things our constitution states) are HIGHER than this piece of paper. Also these measures are especially for this new law - and does not apply to regular raid/search situations. And if they search your rooms without legitimation they'll shoot themselves in their foot. Generally - unless you're a suspectible terrorist (with strong hints) - they cannot simply walk in while you're away. IF they think you're a terrorist, they also can spy on your calls, use a regular search warrant - and in this case they *are* required to tell you afterwards.

For this purpose of installing a trojan on your computers, they are *trying* to circumvent search warrants and the post-search notification requirement.

IANAL, but this document you posted above is currently legally binding in Bavaria - while it violates higher laws. It needs to be struck down.

PS: I prefer to call Schäuble a terrorist, because he stratetigally bombs legal security and privacy better than any other fundamentalist/extremist terrorist.
By my definition, terrorists try to render the political system useless for its people, he doesn't seem any different to me.

Re:Forensic?

[rbrausse]

I hope that the Bunderverfassungsgericht will nuke this barbari - oops - Bavarian law and imo it is unconstitutional but you can't state that the Verfassungsschutz isn't allowed to enter secretly some apartments of suspects to install the famous trojan

Re:Forensic?

[rootooftheworld]

so, politics! = terorists?

what about...

[nabil2199]

...Spartan police?

copy, paste, be done with it

[Anonymous Coward]

These are all the same exact comments as when another country passed a law like this... it was called the PATRIOT act. Only a matter of time before the US forces every country in the world to pass a similar law so they can all work together against the invisible tirrrists. So unless you have something new to say about this disturbing trend, lets just copy and paste the old comments.

fud, Fud, FUD!

[jps25]

I know this is slashdot and jumping at anything so we can scream 1984!!! POLICE STATE!!11!!! gets you modded informative or insightful, but this slashdot article is just crap.

The "Bundestrojaner" will only be used as a last resort and in defense to terrorism, as you can read here in an article posted today, denying the Bavarian request to use it for other crimes not directly related to terrorism.
Poor google translation:
http://translate.google.com/translate?u=http%3A%2F%2Fwww.heise.de%2Fnewsticker%2FBundesrat-will-heimliche-Online-Durchsuchungen-auf-Terrorabwehr-beschraenken--%2Fmeldung%2F110466&hl=en&ie=UTF8&sl=de&tl=en

Ah, screw it. 1984!!! ORWELLIAN STATE!! BURN THE WITCHES!

Re:fud, Fud, FUD!

[jeiler]

I weigh more than a duck you insensitive clod!

Re:fud, Fud, FUD!

[witherstaff]

Oh sure and the US Patriot Act was only for terrorists. It'd never be used improperly or wrongly

Re:fud, Fud, FUD!

[Spatial]

The "Bundestrojaner" will only be used as a last resort and in defense to terrorism.

Sucker.

Re:fud, Fud, FUD!

[TubeSteak]

The "Bundestrojaner" will only be used as a last resort and in defense to terrorism, as you can read here in an article posted today, denying the Bavarian request to use it for other crimes not directly related to terrorism.

It's nice that their requests for non-terrorism uses were denied, but if the law doesn't say that, those denials are temporary and subject to change.

Very few governments or government agencies have the integrity to do what's right, compared to what is legal.

Re:fud, Fud, FUD!

[Yvan256]

But she has got a wart!

Re:fud, Fud, FUD!

[dunkelfalke]

yeah and the toll collect data would never be used for police investigations (or so they said a couple of years ago).
the problem in germany is that even if the evidence was collected in an illegal way it still may be (and often is) valid before the court.

german police and german politicians may break the law as they want and go unpunished.

Re:fud, Fud, FUD!

[thermian]

you stuck that on her! I saw you do it!

Re:fud, Fud, FUD!

[jimicus]

The "Bundestrojaner" will only be used as a last resort and in defense to terrorism, as you can read here in an article posted today, denying the Bavarian request to use it for other crimes not directly related to terrorism.

I did try to read the Google translation (which, as you say, was not very good), and I immediately see a problem.

It's a translation of a news report. Not of the actual legislation. Now, I'm not a lawyer - I'm not even German - but AFAIK the legislation and the interpretation the courts give it is the important bit. News reports are rather less so. And if the law is only intended to be used in a very limited subset of cases, then it should damn well be worded so it can only be used that way otherwise you wind up with things like this:

http://news.bbc.co.uk/1/hi/england/dorset/7343445.stm

Re:fud, Fud, FUD!

[Coraon]

as a witch: I would rather not be burned thank you very much, and take your hunts elsewhere.

Re:fud, Fud, FUD!

[javaman235]

The "Bundestrojaner" will only be used as a last resort and in defense to terrorism

Yes, and who defines "last resort" and "terrorism"? That's a state secret...you just have to trust em.

Re:fud, Fud, FUD!

[syousef]

as you can read here in an article posted today, denying the Bavarian request to use it for other crimes not directly related to terrorism.

So the police requested that it be used for other crimes, and because that request was denied, you ridicule it as some sort of paranoid fantasy that more and more countries are beginning to be run as police states. I find the fact that the police asked for this law to be passed at all disturbing.

Re:fud, Fud, FUD!

[Builder]

What, like the Terrorism Act in the UK? Yeah, they'd never just use that against people they don't like.

I try to refrain from personal attacks, but you are exactly the kind of person that let's fascism grow. It's no good complaining when it's too late.

We already have example after example after example proving that every government will in some way abuse the laws we let them have. The only, ONLY rational response to that is to limit the tools we give them.

Once a law is on the books, you've given it to the current and all future governments and you cannot control what they do with it. Today requests may be denied. Next year they may not.

Re:fud, Fud, FUD!

[Alioth]

Ah yes, just like the RIP Act in the UK was only supposed to be used for cases of serious organized crime - but ended up being used to spy on parents to make sure they weren't trying to get their child into the wrong school, or to spy on householders to make sure they were putting the rubbish in the correct bin etc.

Re:fud, Fud, FUD!

[KlausBreuer]

Sure. Last resort. Certainly.
I mean, this may only be used if there exists an "urgent threat to the existence or the security of the Federation or a country or physical, life or liberty of a person".
Obviously, this will immediately exist if they suspect that you might (yes, might) be a (drumroll, please) terrorist. Which, these days, can be the case if you're wearing a t-shirt with some armed superhero picture at an airport.

Furthermore, as we can see above, "Even where there is a reasonable assumptions on concrete preparatory acts for such serious offenses.". Which means, translated: "Whenever we feel like it. We'll simply claim it was a reasonable assumption, after all, that guy kept wearing such weird t-shirts"

I wanted to insert some 1984-joke here, but (living in Bavaria), I don't feel much like joking anymore.

Can American Police not do this?

[Simon (S2)]

I am actually surprised to read this on Slashdot. I thought this was already common practise in the US? I really thought that the police can get a court order and install bugs, microcameras and trojans and whatnot on a suspects computer.

Re:Can American Police not do this?

[the eric conspiracy]

What puzzles me is why this would be something the Bavarian Parliment would do. I would think this would be done at the national level; US laws that enable wiretaps are all at the Federal level.

Re:Can American Police not do this?

[gruntled]

Not so common (few law enforcement agencies have the sorts of resources to make this a common occurence), but yes, that sort of thing is allowed if a judge authorizes it. The idea here is that the judge is supposed to be a neutral party who will evaluate whether law enforcement has enough evidence to justify this sort of thing. (One could do this without a judge's approval, but any data collected in such a fashion could not be used in court; plus you'd risk jail time yourself or at least you'd have your badge pulled).

That's the big reason that people in the US have become so enraged by the revelations about routine monitoring of telephone conversations of US citizens by US agencies with no oversight (we won't even discuss the fact that it was being done by the National Security Agency, which is actually forbidden by law to collect information within the United States...that's the FBI's job...)

Re:Can American Police not do this?

[mdmkolbe]

I think you need to distinguish between monitering communications in transit (e.g. phone taps), and actively entering someones place of resedence to place a bug. The former is clearly legal with a court order, but I'm not sure about the later. The same applies in the computer world. It is one thing to intercept e-mails as they pass through the ISP, but to "break-in" to someone's computer to place the trojen is a complete other level. Further, are the police allowed to cause property damage in the process of placing such a bug (whether physical or digital)? If not, then it would be hard to insert the trojen as turning a clean machine into a compromized machine might (IDK, IANAL) be considered property damage.

Re:Can American Police not do this?

[gruntled]

Courts have held that a physical intrusion can be legally valid. In 1999, the FBI was granted a covert search warrant by a judge to install a physical key logger on a computer belonging to the son of mafia chieftain Little Nicky Scarfo after a search warrant revealed the computer had encrypted files. The feds came back in two months, pulled the encryption key off the key logger, and used that to crack the encrypted files. At trial in 2002, federal judges denied Scarfo's junior's claims that the intrusion violated his rights.

Cause you did it wrong :-)

[MacDork]

No, it simply doesn't have that ring to it.

In Bavaria, trojan cremes you!

Re:Where?

[Spatial]

We're not bombing them so the news doesn't show the country on a colorful map.

Apparently even that doesn't help too much.

translation error?

[ZeroZeeds]

.. Even where there is a reasonable assumptions on concrete preparatory acts for such serious offenses. Have a terrible feeling that should say no reasonable assumptions or concrete preparatory acts

Yeah, Wiki got...

[TransEurope]

...the point! http://img512.imageshack.us/img512/9159/germanybavariaalpschurcob4.jpg

Jawhol.

[FlyingSquidStudios]

Ve haff vays of makink your computer talk.

The straight dope...

[spectrokid]

Listen up folks. There is only ONE reason why you would ever want to visit Bavaria. Yes. Ahum. For those of you not in the know, it has something to do with jugs. Large jugs. Yes. Ahum. One thing is certain, it does not require the presence of a computer anywhere near the place.
One might even suggest the use of a computer to be quite counter-productive near aforementioned jugs. Ahum. Jugs.

Re:The straight dope...

[Brett Buck]

Oh, I'm pretty sure that for anyone here to take advantage of said bounty, they will end up needing a computer.

          Brett

Re:The straight dope...

[dbcad7]

For $30 They'll let to touch and play with these jugs all you want !...

http://www.tias.com/cgi-bin/google.fcgi/itemKey=1923082444

Re:The straight dope...

[32771]

Good point!

He probably meant mugs:

http://www.hofbraeuhaus.de/de/bilder/view_en.php?id=gast_bedienung.jpg&gal=0&pg=0&count=2

She doesn't quite have the jugs he might be thinking of, she is pretty though.

will they hold?

[e**(i pi)-1]

I doubt that trojans can be stretched to cover an entire PC.

How is this different than a telephone wiretap?

[hasbeard]

Not that I am crazy about those, but hasn't government always had the right to intercept communications under certain circumstances? Why should the fact that this is a method for doing so on a computer make this case any different?

Re:How is this different than a telephone wiretap?

[mdmkolbe]

A wire tap intercepts communication while it is in transit. That would be similar to intercepting e-mails when they pass through the ISP. On the other hand, this trojan would be closer to the police secretly breaking into your house in order to place a (webcam?) bug.

While the former is clearly legal (with a court order), I'm not sure if the later would be. It would be dangerously close to a secret search and I imagine that while the police can serve a search warrent if you happen to not be there, they can't purposely wait until you are gone in order to serve the search warent. (Any one know any court rulings on this?)

Sounds normal

[nurb432]

With a warrant the police can do that here i the US too.

Warrants can be issued for 'suspicion'.

Re:Sounds normal

[mdmkolbe]

A wire tap intercepts communication while it is in transit. That would be similar to intercepting e-mails when they pass through the ISP. On the other hand, this trojan would be closer to the police secretly breaking into your house in order to place a (webcam?) bug.

While the former is clearly legal (with a court order), I'm not sure if the later would be. It would be dangerously close to a secret search and I imagine that while the police can serve a search warrent if you happen to not be there, they can't purposely wait until you are gone in order to serve the search warent. Any one know any court rulings on this?

Re:Sounds normal

[nurb432]

Bugging your house with cameras and microphones is legal with the proper court order, so i don't see any difference.

They can wait until you are gone under some circumstances, and setting up for long term surveillance would qualify.

Re:Sounds normal

[mdmkolbe]

If that is the case, then I agree there is no difference.

Do you have any citations for this? It just seems that with secret searches it would be all too easy for the police to plant evidence or make other false claims about what was found.

Re:Where?

[RiotingPacifist]

Thats simply because not enough of it is on fire to make it stand out on google earth!

Encrypted Drives

[nurb432]

If you encrypt your drive, and don't leave it running while you are gone, unless they guess your password not much they can do.

Re:Encrypted Drives

[the_one(2)]

they can install a hardware keylogger, they can install a hypervisor or similar

Re:Encrypted Drives

[nurb432]

Hardware i agree.

But i think that a miniscule hyper-visor based monitor would have troubles with encrypted booting, and would have to be OS specific since so many now bypass bios ( and thus standard keyboard/video routines )?

Re:Encrypted Drives

[the_one(2)]

I don't really see how encryption matters and Xen for example (obviously it wouldn't need to be as advanced as xen) can run most OSes without a typical user noticing it (or maybe it's impossible to know at all? I don't know that much about this).

Re:Encrypted Drives

[nurb432]

I agree something like Xen supports most OS's , but I think if someone installed a *full* VM you would notice. I was thinking they would only get away with a tiny one, and it would be limited on what it could support/emulate. But i suppose if they were targeting you personally, they would know what PC you had and what hardware it had to emulate.

I know id be suspicious if suddenly my video card changed overngight....

Re:Encrypted Drives

[nurb432]

Forgot to add, the encryption would prevent them from making any changes to your OS's drivers.

Re:brokenlink

[RiotingPacifist]

Its ok nobody RTFA so it doesnt matter if it works or not

Ok

[labmonkey09]

I got an error at the link,,, so what's different about this versus a wiretap? Is the procedure for getting authorization any different? Tell me you need a warrant and I'm going ask why we are reading about this ... tell me they can just install it and run, on a whim and I'll be interested.

bullcrap

[unity100]

The "Bundestrojaner" will only be used as a last resort and in defense to terrorism

when the law that allows the police to monitor ALL communication (email, gsm, landline) at all times, without needing any warrant was passed here, (turkey) and gave the daily running of the operation to a small board that would be directly appointed by the prime minister and his cabinet, many idiots believed that 'only as a last resort and in defense against terrorism' bullshit too.

then somehow the private conversations of opposition party members who have had a strife with the administration have been leaked to the newspapers and media that were backing the administration. then the private conversations of state attorneys have somehow leaked to the same islamist newspapers. then suddenly the conversations of generals that are opposed to the islamist party (the military is tasked with ensuring the continuance of secular, western style republic, according to turkish laws) have somehow slipped to islamist newspapers backing the administration.

yea. there were idiots who were believing that it would only be used as a last resort and against terrorism here too ...

What scares me...

[denmarkw00t]

"The RFS may be used to read, delete, and alter data"

Get ready to commit crimes that never happened, only in Bavaria!®

Inadmissible?

[ThatsNotFunny]

If the software they install can delete and alter files, how can any evidence they procure be admissible in a court of law?

Re:Inadmissible?

[KlausBreuer]

Oh, don't worry - it will be. They'll simply swear that they didn't change anything, that this eeeeeevil letter was written by you, and thus you obviously should go behind bars for the next 250 years.

(No, I do not trust the gouverment. Yes, they do crap like this all the time).

Not Gestapo, but Stasi 2.0

[PolygamousRanchKid]

... well, this certainly explains why all those Stasi 2.0 (http://en.wikipedia.org/wiki/Stasi_2.0) stickers have shown up here, stuck up on stuff around the ranch . . .

Where have I heard this before?

[Per Wigren]

Oh yes, this sounds exactly like other totalitarian countries, like China, USA and Sweden.

Trojans?

[Darkfire79]

They want to stick condoms on my computer? :oP

Please

[Orion Blastar]

Bill Clinton had Carnivor and Magic lantern for this sort of thing long before Bush was even in the White House, around 1995.

The Federal government has been violating due process and the US Constitution since FDR was in office.

Don't try and pretend that Bush was the first to do this sort of thing with the Patriot Act, all he did was use it to amend the Constitution.

Re:Please

[scaryjohn]

The Federal government has been violating due process and the US Constitution since FDR was in office.

Really? We didn't violate due process before FDR? I know you were trying to make a point, but what about Wilson? Lincoln? Jackson? Or Adams? How about Washington?

Re:Please

[tiananmen tank man]

The USA PATRIOT Act was passed by wide margins in both houses of Congress and was supported by members of both the Republican and Democratic parties.

Seems like you are showing your bias with your reply. The anonymous GP didnt even mention Bush, yet you fire back with a reply about Clinton.

From the summary, it seems like the Bavarian police can enter a persons home and search without the person's knowledge. My understanding is that the USA PATRIOT act allows 'law enforcement officers to search a home or business without the ownerâ(TM)s or the occupantâ(TM)s permission or knowledge.'

Even American employers can do that

[Orion Blastar]

to spy on their employees. Sure it is unethical, and maybe morally wrong, but they do it anyway.

Bill Clinton had the FBI use Magic Lantern for that vary purpose.

Re:Even American employers can do that

[mdmkolbe]

No, they can't. They can have such software on company issued computers. But breaking into the personally owned computer that an employee has at home, never.

Re:Even American employers can do that

[Orion Blastar]

Not only could they, but they already have done that. At least some of my former employers did that to me on my home computers.

Re:Even American employers can do that

[mdmkolbe]

I'm sorry, but I'm going to need a citation for that or some sort of proof.

Re:Even American employers can do that

[Orion Blastar]

I guess the Magic Lantern article wasn't enough for you then?

How to legally spy on your employees and Spy cover up

Major employers such as Delta Air Lines and Google have fired employees for what they put on their own blogs. Ellen Simonetti, a Delta flight attendant, says she was fired in October 2004 after she posted pictures of herself in her uniform in suggestive poses on her blog.

"Employees should know that your employer is looking over your shoulder. If they catch you, they're canning you," says Nancy Flynn, executive director of The ePolicy Institute and author of Blog Rules. "You can be fired for anything, even for blogging right at home in your jammies."

Spy software can be used at work or at home to spy on employees and is marketed as so and Boeing used it like that.

Re:Even American employers can do that

[mdmkolbe]

None of these links refer to (1) private companies that, (2) place trojans or other software on (3) personal non-work computers.

Magic Lantern? Government institution. Different rules (regretably).

The other links? They say nothing about personal non-work computers. They only say that either work computers are bugged, or the people might be tailed by a PI.

Re:Even American employers can do that

[Orion Blastar]

You missed that employers fire people for blogging at home in their jammies and can view private home phone records via pretexting. You also missed that Boeing, Delta Air Lines, Google, and HP spied on home computer use. If you aren't even going to bother to do reading comprehension of articles I cite, there is no point discussing it with you.

Re:Even American employers can do that

[Orion Blastar]

First all I said was that employers spy on their employees even at home. I didn't mention private companies or trojans, that is a misunderstanding on your part.

Second the Magic Lantern article states that the FBI phased it out for commercial software that does the same thing and some companies use that as well.

Third ever since Windows XP there is a remote access feature of the OS that can be exploited for anyone to gain remote access of an XP system unless the user knows how to turn it off.

Fourth ever since NT 4.0 there has been an NSA backdoor in Windows and an employer or hacker can use that to spy on employees of that company. So there needn't even be a trojan to install as Windows has a backdoor in it that can be used that way.

Fifth trojan or PI or pretexting whatever the method should be illegal to do but employers do it anyway to spy on employees at home and seem to get away with violating human rights.

Sixth, this is basic knowledge that almost every average Slashdot reader should know based on their Geek background, which makes me suspect that you are a mole for corporations that spy on employees and you are trying to cover up that fact.

Re:Even American employers can do that

[mdmkolbe]

Yeah, I read them, and (with the exception of the HP case) they do not indicate that any of those companies spy on home computer use. They may spy on their computers at work and spy on them when they are in public view, but nothing is said about home computer use. As one of the articles said "short of breaking into someone's home" these things are legal, but it is that home line is precisely the subject of debate. (Things posted on a blog are publicly posted and so reading them isn't spying on home computer use and is perfectly legal.)

The HP case on the other hand is interesting precisely because it proves that these sorts of actions are criminally illegal. Whether they get successfully prosecuted may be in doubt, but the subject at hand is whether by the letter of the law an employer can install monitoring software on a home computer without the employee's consent. Given the number of anti-hacking laws out there (unauthorized access of a computer anyone?), I think it is a pretty clear case that these actions are illegal.

Re:Even American employers can do that

[mdmkolbe]

Actually you said "Even American employers can do that to spy on their employees." The anticedent of "that" was "bugs, microcameras and trojans and whatnot on a suspects computer". All of your other points are not germane the the question.

Oh, yeah. If you think I'm a corporate mole, well then I guess I've been successful in hiding my real identity. Mhuahahahah...*cough cough*...ahem.

Ironically it is admissible

[Orion Blastar]

in a court of law even if the trojan is programmed to download porn and other things over the Internet. I can recall American employers using trojans like that to fake employees surfing the Internet too much to fire them for it. "He surfed for porn for more than 5 hours each day, so he fired him" when really the trojan surfed porn and planted it on his computer. They do that sort of thing when they want to discriminate against an employee for their religion, race, color, national origin, disability, age, gender, or whatever. It is a way to avoid discrimination laws and civil rights, just fake evidence that the employee did something wrong and that is good enough to get a court to agree with you that you didn't violate his/her rights.

Re:Ironically it is admissible

[mdmkolbe]

Faking evidence is illegal and inadmissible. Now you may get away with it if you aren't caught, but it is still illegal and inadmissible.

Episches scheitern...

[MRe_nl]

Fehlermeldung

404 - File not found
Leider ist die von Ihnen aufgerufene Seite auf diesem Server nicht vorhanden.

Bitte überprüfen Sie:

die Schreibweise der URL (Groß- und Kleinschreibung beachten!).
Ihren Bookmark.
die Seite, von der Sie gekommen sind.

Re:Episches scheitern...

[getuid()]

Try this: http://www.heise.de/newsticker/meldung/110426

Talk About Needing a Bill of Rights

[Nom du Keyboard]

As bad as you want to say things have gotten in the USA, it's nothing like this yet. And all his contacts too? Wow!

" 'd be against the law"

[getuid()]

"The RFS may be used to read, delete, and alter data" Get ready to commit crimes that never happened, only in Bavaria!®

"Naw... wouldn't happen... Police wouldn't frame you with things you haven't done... 'd be against the law!"

Believe it or not, that's the first counter-argument if you speaking against the recent legislation.

(used to live there long enough)

No

[wideBlueSkies]

No, they can only screw you if you're running a Windows OS.

They probably install some variant of Back Orifice before slamming in the Trojan.

Bavarian Parliament and Federal Parliament

[getuid()]

What puzzles me is why this would be something the Bavarian Parliment would do. I would think this would be done at the national level; US laws that enable wiretaps are all at the Federal level.

They tried to. It came as far as the constitutional court in Germany, and failed miserably. The law now returns, slightly changed.

You have to know that in Germany, each "Land" (~County) has its own law. If there's a matter on which both a county's law and federal law exist, the federal law supercedes county law. The federal law on computer trojans failed before the constitutional court. It's been slightly changed and they're going to give it another try on the federal level the next few weeks. Meanwhile, Bavaria layed out its own law regarding trojan infection of suspects' computers. It will probably also fail before court as soon as somebody bothers to sue (and a lot will, believe me), but until that happens, it's there and it's valid.

I suspect it's all some show-off attempt for big guys in politics, along the lines of "look, we were the first to arm our police with the necessary tools against terrorism", paired with a boxcar load of right-wing attitude...

Although this law will get smashed soon, it pretty much shows there the wind blows from in Germany. Or Europe, for that matter. Or the world...

Re:Bavarian Parliament and Federal Parliament

[the eric conspiracy]

Well, at least you know who not to vote for next time.

Typo in title

[gmuslera]

Barbarian Police Can Legally Place Trojans On PCs

The Security of the Federation is at stake!

[Rick Genter]

...RFSs may be used in cases of an "urgent threat to the existence or the security of the Federation...

Of course! There is no other way to deal with the Borg; if we don't use RFSs, it could mean the end of existence for the entire Alpha Quadrant, not just the Federation!

Cue the condom jokes, in

[dos4who]

3... 2... 1... ~m

mmmmhhh the comnparison is no good

[aepervius]

When thinking of the GeStaPo (Geheime Staat Polizei) Most people will remember the torture , the sending to concentration camp, the executions, the kidnapping and nobody see you again, rather than the petty search in secret. You know, like nearly all security/spionnage agency of the world are doing right now, like DGSE, CIA, And sometimes even the police in the middle of an inquiry when they don't want to alert the perp etc...

Sorry, you are wrong

[kju]

Sorry, most of what you said or suspected is wrong. The system is actually a very clever design which prevents interruption of data/fax calls by the phone and in fact also eavesdropping from another phone inside the house.

The "multi-way phone sockets" are usually of the NFN-Type. Here F means "Fernsprecher" (Phone) while N means "Nicht-Fernsprecher" (Non-Phone). The socket is designed so that the line goes first to the left N socket , then to the right N socket and finally to the F socket. The phone will always be the last in chain. A non-phone device (fax, modem) plugged into one of the N sockets is supposed to have two electronic switches inside which will chain-through the line to the next socket when the device does not use the line. So if you are not sending a fax or surfing the net, you will be able to use the phone normally. However when the fax/modem takes over, the phone will be cut off. This clever trick prevents you from interfering with the transmission by picking up the phone.

As you are not supposed to plug two phones into one box, this also prevents eavesdropping. Overload prevention is not the reason. There were and are devices available which either are put before the NFN-box and allow to wire another NFN-box or contain a F or NFN socket themselves. Both will allow to wire a second phone and of course you could use more than one of these devices. These device however contain a automatic switch will will cut-off the other phone when one is in use. But they will all ring.

Re:Sorry, you are wrong

[kju]

A non-phone device (fax, modem) plugged into one of the N sockets is supposed to have two electronic switches inside which will chain-through the line to the next socket when the device does not use the line. So if you are not sending a fax or surfing the net, you will be able to use the phone normally. However when the fax/modem takes over, the phone will be cut off. This clever trick prevents you from interfering with the transmission by picking up the phone.

One addition: The design can also be used to detect if the chained-through phone is picked up. This allows to design for example a answering machine (plugged into N) in such a way that the machine automatically stops when the phone is picked up, allowing the human user to "take over" the call from the machine.

Re:Sorry, you are wrong

[Pogue Mahone]

OK I stand corrected. But there's still a bewildering selection of NFN NF f and N boxes on the market, and I'm pretty sure I saw a box with 2 F's and an N too. In any case, in practice, the boxes in different rooms in a flat or house are typically wired in parallel, thus nullifying any disconnection effect - that only operates locally in the boxes.

Re:Sorry, you are wrong

[Hal_Porter]

Sorry, most of what you said or suspected is wrong. The system is actually a very clever design which prevents interruption of data/fax calls by the phone and in fact also eavesdropping from another phone inside the house.

The "multi-way phone sockets" are usually of the NFN-Type. Here F means "Fernsprecher" (Phone) while N means "Nicht-Fernsprecher" (Non-Phone). The socket is designed so that the line goes first to the left N socket , then to the right N socket and finally to the F socket. The phone will always be the last in chain. A non-phone device (fax, modem) plugged into one of the N sockets is supposed to have two electronic switches inside which will chain-through the line to the next socket when the device does not use the line. So if you are not sending a fax or surfing the net, you will be able to use the phone normally. However when the fax/modem takes over, the phone will be cut off. This clever trick prevents you from interfering with the transmission by picking up the phone.

As you are not supposed to plug two phones into one box, this also prevents eavesdropping. Overload prevention is not the reason. There were and are devices available which either are put before the NFN-box and allow to wire another NFN-box or contain a F or NFN socket themselves. Both will allow to wire a second phone and of course you could use more than one of these devices. These device however contain a automatic switch will will cut-off the other phone when one is in use. But they will all ring.

Yeah, but why are people trying to prevent eavesdropping from inside the same house? If you really wanted to do it you'd just alter the wiring inside the box.

And what I thought was funny was how all this obfuscation was explained by referencing the Nazis, as if that somehow trumps any argument about the pointlessness of the scheme. If I wanted to eavesdrop on someone inside the same house this scheme won't stop me. In computer terms I have root access to the phone wiring in my house an so I could disable the switches that stop me eavesdropping. Or more likely I'd pop down to the electronics store and buy a slightly different box that allows parallel connections.

And as I pointed out, if a dictatorial government wanted to tap phones they would do it at the exchange. Privacy laws wouldn't stop them either, they have root access to the justice system and so they could change the laws or just ignore them.

Re:Sorry, you are wrong

[32771]

>Yeah, but why are people trying to prevent eavesdropping from inside the same house?

We have mothers in law too :).

Suddenly Saddam Hussein doesn't seem that bad

[nx6310]

Especially since the main reason to cover up the WMD search in Iraq was to rid the ppl of a police state etc...

Maybe one day Iraq will lead a campaign to rid the Northern Hemisphere of police states to return the favor. I think the only difference nowadays is G8 regimes have more resources to make it look more Legalish.

This looks an awful lot like a Nazi police state

[Cannelloni]

If I was German, I'd emigrate right now. Heinrich Himmler would be so pleased.

very efficient

[speedtux]

RFSs may be used in cases of an "urgent threat to the existence or the security of the Federation or a country or physical, life or liberty of a person...

Apparently, they are drawing on a century of experience that Germany has with intrusion into people's private lives, both under right wing and left wing extremist states. Even the language of the law itself is... classic.

Fruit of the Poisoned Vine

[redelm]

Ah well, the Bavarians are doing their independence thing, sharply deviating from the Federal Verfassungsgericht. And probably from the EU Charter of Rights and Freedoms. They know it, and are doing it precisely for that effect.

But watch: there will be abuses immediately (cops cannot help themselves, they have a compulsion to "fight crime") and in about 3 years one will be egregious and funded enough to make it to seriously senior courts. Then one of these (especially the EU) will seek to exert its' jurisdiction with a ruling like the US "fruit of the poisoned vine" doctrine.

Odd thing is, the bayricherbeamter are anything but stupid and may even see and desire this.

Why not?

[Lars T.]

Bavaria's capital is big on using Linux - and what better target could the conservative Bavarian state government find than the liberal city council of the capital?

Still legal for AV software to block it?

[Kazoo the Clown]

So what does the AV software vendor do when it encounters the "signature" for a trojan that has been set up by some government? If AV vendors weren't already pretty darn screwed by the fact that their methodology is seriously flawed, this would push them over the edge by itself, I would think...

So, this is what one needs to do:

[mlwmohawk]

Run Linux
Encrypt Boot and home disks.
Encrypt everything.
md5sum *everything*
Boot off a knoppix or install CD periodically.
Keep a spare motherboard around and/or change motherboards frequently.
Always buy a name brand ethernet card that is a different chipset than your motherboard.
Run wireshark on your laptop which you *NEVER* let out of your sight.

Remember, thieves will only steal your stuff. The government will steal your life and liberty if it is politically possible.

Re:So, this is what one needs to do:

[rootooftheworld]

coLinux(hidden) with windows AND/OR steganographic file system OR/AND they can put all the trojans they want on windows, what do you care? you just kill the image-booted ramdisk based VM that windows is inside, and use your otherwise hidden linux install. My $0.02.

BitLocker + TPM

[cbhacking]

True on the keylogger (but then, you can see those - especially if, like me, your home computer is a laptop).

However, if the the computer has a TPM chip and is using BitLocker, then no, they can't install a hypervisor - by necessity, the hypervisor changes the boot instructions, which would cause the (TPM-enabled) boot validation in BitLocker to fail and the drive will lock itself until the recovery password is entered (and no, it's not guessable - it's a very long machine-generated value). Barring a really stupid user who ignores the warning that the boot sequence changed, this is about as safe as you could get.

I don't know how TrueCrypt or similar would handle this situation, but as long as a strong password and boot validation are used, full-disk encryption would probably be effective against this.

Bavarian Fire Drill!

[Stormy Dragon]

Remain calm everyone! Please move to the back! No pushing!

I think I spot a teeny, tiny flaw...

[nick_davison]

The RFS may be used to read, delete, and alter data.

So, getting this straight... They have the right to modify data in ways that can't be [reasonably] detected... and then they can use this data to press charges?

"Of course not your honor! It was different data we changed. The incredibly convenient file that says, 'I am guilty, it's a fair cop, guv! Oh yeah, it was me!' was there all along."

You're on incredibly shaky ground when you allow the police to manufacture information where they may subsequently use information to support charges. As soon as one dirty cop gets caught manufacturing evidence, you've devalued the entire method for gaining it. How long before the standard defense becomes, "My client has never seen that file before. Given the police routinely add and modify files on people's computers, prove beyond a reasonable doubt that they didn't put it there themselves and then change the logs to simply make it look like my client did it."

Ohmygod what a crap.

[haraldm]

Seems you were taken for a ride by some obscure kraut. Or yours was a July 4 joke.

There are 3 (or 4, depending on how you take it) different types of "TAE" phone sockets here. A single one for a phone (coded "F"), a dual one for a modem and a phone (coded "N-F"), where the modem or answering or fax machine plugs into "N" and cuts off the phone socket when active, and a third one which combines a N-F socket with another F socket accomodating 2 lines (coded "N-F-F"). There are also "N-F-N" types for special uses. Your flat or hotel room apparently got only a "F" socket. Next time you come to Munich you visit one of the electronics stores in Schillerstrasse and buy an N-F socket for 3.50 Euros and exchange it for the F socket.

No nazi conspiracies here. Duh.

By the way the German federal constitution court in Karlsruhe already ruled online searches of the said kind unconstitutional, and the law now passed will most probably get probed there, and fail. Why in the world the Bavarian government would do that I've no idea. Any Bavarians here who can shed some political light on it?

Correction

[Sapphon]

Stasi = secret police, not secret people.

Keylogger

[iknown]

As far as i know they use this Keylogger. I read that lots of polices and governments agencies use that All In One Keylogger.

UND NONTEKNISCHEN LOOKENPEEPERS?

[not_hylas( )]

See Blinkenlights:

http://en.wikipedia.org/wiki/Blinkenlights

Shot in the dark?

Re:Where?

[32771]

Glad I'm 700km to the east. They might have introduced that law because of the dope though ;).

Its "might makes right" I guess, no matter what well meaning people are trying to tell you.