Slashdot Mirror
European Police Plan to Remote-Search Hard Drives
Smivs points out a blandly-worded story from the BBC with scary implications, excerpting "Remote searches of suspect computers will form part of an EU plan to tackle hi-tech crime. The five-year action plan will take steps to combat the growth in cyber theft and the machines used to spread spam and other malicious programs. It will also encourage better sharing of data among European police forces to track down and prosecute criminals. Europol will co-ordinate the investigative work and also issue alerts about cyber crime sprees."
Wow, good thing I have a firewall, built right into my router.
In a statement outlining the strategy the EU claimed "half of all internet crime involves the production, distribution and sale of child pornography".
And the other half is copyright infringement?
Can you repeat after me?
When this is implemented, it will be....
duh du duhnnn
Wait for it.....
"The year of Linux on the desktop"!
Support NYCountryLawyer RIAA vs People
you frequently here discussions on slashdot about grey hat activities: going to computers hosting worms, and shutting down the worm remotely, for example. and you hear many people here supporting that
now in europe, this is exactly what they are going to do: shut down zombies, shut down spam relays, and everyone on slashdot babbles incoherently about teh ev1l gubmint invading our computers. when such european effort sprobably sprang directly from the kind of strategizing peopl ehere on slashdot frequnetly engage in enthusiastically
its like the propaganda and hysteria over the lori drew case, which carries no precedent because it is such an extreme outlier
so:
do you care about rights and freedoms?
you do?
then react to REAL and GENUINE threats to them
if you instead spastically flail out everytime someone words an article in a propagandistic manner, you are no defender of rights and freedoms, you are merely a manipulated hysterical fool. and, in fact, someone useful for the suppression of our rights, by proving to those who wish to restrict our rights that people don't even understand what their rights are
defend your rights and freedoms
against genuine threats
not smoke and mirrors... thereby demonstrating you are a spastic twit who doesn't even know what your rights and freedoms are
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
What it sounds like to me is that police departments will be able to search other police departments' computers. Not police searching civilian computers. The whole article is vague by using the term "remote searches" and not giving any more explanation.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
how would this work? since to access my hard drive to search it, they would need.
1. me to be on the internet at the time they want to search my drive.
2. my to give them access to my machine via a remote desktop style connection, which would involve me giving them a username and password to my machine.
or
1. me to be on the internet at some point
2. mandating that EVERYONE in the EU runs an application that indexes the entire of all the hard drives connected to a machine, and transmits the index to a central location whenever an internet connection is made.
unless they are simply on about remote searching of their own networks, and their own drives... which they can already do...
portfolio
You know, it's awfully hard to not be yet again reminded of Orwell here. Constant surveillance and no privacy from the government so they can monitor everything you do.
But, of course, if your machine is behind a firewall, they'll just outlaw having firewall because it impedes their ability to investigate you for crimes. At which point if you need to be insecure enough to ensure that law enforcement can get in and do this, your machine will be hosed within the hour as the actual bad people break through as well.
This will either fall apart as un-doable, or spark some absurd laws to enforce it.
Cheers
Lost at C:>. Found at C.
Unfortunately, the article cited is maddeningly vague as to how this initiative will be implemented. A little digging turns up this Register article on the subject, which contains slightly more info.
From the Register article:
So, in short, here's just one more compelling argument for ditching Windows for Linux...
____
~ |rip/\/\aster /\/\onkey
I would be worried that this would be badly worded and over-broad.
But, being a citizen of the UK, I know that even if legislation were made like this, then Her Majesty's Government would never abuse its powers and apply it to situations which were not originally intended.
Just like the anti-terrorism legislation.
Oh, hang on...
Sean Ellis
Follow OfQuack's antics on Twitter.
...to roll-your-own OS. Or use one that's been built by and for the community with all the source code visible for all to see. Proprietary binaries? You don't know what's squirrelled away in there...
You don't know what's squirreled away in the Linux kernel, or any other open-source product you didn't entirely write yourself.
It's very easy to hide something nefarious in just a few lines of C (see the obfesicated C contesr for examples). If the NSA or a group of smart enough criminals wanted to hide something in a major open-source project, they almost definately could.
as I sit here in a cafe, my laptop connected to some unsecured AP far awqay with a biquad wifi antenna, I say go right ahead, search my hard-drive, but don't forget to bring a good map and a gonio antenna to find me in case you realize I'm not the poor guy whose house you're about to raid.
This will never work, there are way too many anonymous internet connections around for this 1984 scheme to work, and people who have something to hide usually don't leave stuff hanging around unencrypted on their hard disks.
Even visible source code isn't entirely safe:
http://cm.bell-labs.com/who/ken/trust.html
Always a fun read.
I am officially gone from
or
1. search your computer through backdoor built into closed-source operating system.
we see things not as as they are, but as we are.
-- anais nin
If the police are planning to "remote search" hard drives, they'll need something on the client that lets them do so, along with some sort of command and control/results reporting channel between the client and the (totally secure and definitely not going to get breached in an embarrassing display of incompetence that will go utterly unpunished) police HQ.
In the short term, that means some flavor of spyware. The disconcerting bit, though, is that said spyware would look and act like normal spyware; but be part of a police investigation. Generally, interfering with those is a crime. Will removing that spyware be considered obstruction of justice? Will blocking its operations or reporting be considered obstruction of justice? "Your honor, the defendant did maliciously configure his router to drop outbound justice on port 315..." In order to be effective, spyware has to be covert and subtle, so it will be damn difficult to distinguish fedware from ordinary spyware.
Worse, of course, is the medium to long term: if "remote search" is the law of the land, it will soon enough seem like a good idea to mandate a few features from hardware and software manufacturers to make it easier. Make an antivirus program? Well, you'd better be sure that it ignores the activities of any app signed by $AUTHORITY, if you want to stay out of jail. OSes could easily do similar things with process listings, priviledge escalations and the like. Even hardware could get in on the act. In principle, you could build obedience to cryptographically signed orders into all sorts of devices. This would be bad in all the ways that DRM usually is, only worse.
Unfortunately, this sort of turn doesn't seem entirely unlikely. Digital surveillance is all the rage these days, and unlikely to get any less popular, and there are few jurisdictions that have any terribly encouraging history of resisting it. Specifically, the EU has comparatively strong privacy legislation; but it is written from the basic philosophy that privacy is having the state control other's access to the data it collects, rather than privacy being having those data never collected. The US is stronger on that score(at least in theory, and as long as drugs, kiddie porn, and terrorism aren't involved); but the state of private sector privacy is absolutely miserable and there is nothing stopping the state from simply buying surveillance from said private sector(which it indeed does, on a fairly massive scale).
If they search your /dev/random long enough they'll eventually find kiddie-porn so the joke's on you.
Enjoy prison
Indeed...one need only look at the last eight years in the U.S. for the proof of this statement.
Oh, wait...
____
~ |rip/\/\aster /\/\onkey
With mild encryption so it gives them some time to kill.
Could be fun, could also backfire, I mean if they are allowed to do this they'll eventually be allowed to arrest you for wasting their time by doing something like that.
Blah.
I'm moving to Russia.
I find it interesting that you are complaining about the last eight years in the US, yet the article is about Europe...
IMO, it shows the anti-US sentiment, apparently because of the US's more or less high position in the world, as opposed to many European countries that are trying to rival it with the EU, etc., but failing.
And yet, The UK and Europe have far worse "wire-tapping" sorts of things than the US. But it's not in vogue to complain about it anywhere but in the US, it seems.
The Linux kernel is enormous and monolithic, which is why it is vulnerable to that sort of activity. But a smaller, microkernel design like Minix is easier to inspect, for those who have the time to do so. If you are truly concerned about people sneaking code into your OS, your best bet is to go with a microkernel and put in the effort to inspect that kernel and any relevant drivers; if you do not have that time, then you just need to trust others to do the inspecting for you.
Palm trees and 8
Dude, I am so spending tonight checking /dev/random to see if Half Life 7 has been releasd yet :)
i wont allow it. and thats final.
Read radical news here
Oh, the irony of this is hilarious. Linux is now more cumbersome to work with than the operating system which caused Linus to write the Linux kernel in the first place. I'm sure Tanenbaum will be proud that he's come full circle. :-P
Besides, all of the stuff one layer up from the microkernel would still need to be checked for security, so I don't really think it buys you anything. The operating system is more than just the kernel.
Cheers
Lost at C:>. Found at C.
It's real easy for them to do.
Step 1 : Hand out free or discounted internet access. This may include higher than average datarates or fiber access making it really attractive to the end user. The caviout is that you must also run a software package on the machine or the connection is revoked. Said software includes the drive scanner and identification credentials.
Step 2 : Pass regulation that makes traditional anonymous internet access prohibitivly expensive for the individual user.
Ta da! The net is no longer anonymous and big brother is watching.
The summary takes the decision somewhat out of context.
They're not planning to remotely connect to any old joes computer they can and search it, they're planning to connect to zombie computers that have been hijacked by criminals to try and trace back where the criminals are coming from.
Apparently, there will be strict rules on what they can do on said machine too, that is, they're not allowed to start rummaging through people's personal data. Don't think I'm naive by saying that- I'm just repeating what I read on the issue, I don't believe for a minute those rules will be enforceable and I truly think as soon as they have access to these machines and their boss aint looking they're going to start rummaging like crazy.
I'm not sure how I feel about the general idea, if a machine has a backdoor and they can manage to connect to it also then in a way I feel they should just temporarily patch it for the user and inform the user at absolute worse although I'm not sure this is ideal- what if they patch some security researcher's honey pot for instance!
It certainly concerned me a bit when I read it but it's certainly not a plan to just use 0-day exploits to connect to everyone and anyone's PC or anything.
A grey hat in his basement can give me a trojan, perhaps fuck up my computer. The government can send hordes of armed men round to my house and lock me up for the rest of my life. Although I do probably trust the government more than some random, I know which one I am more scared of.
Actually, he's right. The intel-compiled gcc might be faster than the gcc-compiled gcc, but their (the 2nd generation compiler's) outputs should be identical.
Don't whistle while you're pissing.
They're not two unrelated compilers.
Reread the GP.
Compare the output of GCC compiled with GCC to the output of GCC compiled with ICC.
The compiler doing the final output is the same - GCC. The compiler doing the intermediate compile is different, but it's compiling the same GCC source code for the compiler for the last step. Which means, functionally - but not binary - icc_gcc_gcc and gcc_gcc_gcc should be identical. It would then follow that they'd produce identical output from the same source code.
Now, I'm not a C programmer, so I could just be talking out of my ass here, but it logically makes sense.
"City hall" in German is "Rathaus" Kinda explains a few things......
They need to move with the times. Classical crime rates have dropped so much since medieaval times that a whole new list of crimes has to be thought up to keep the enforcers busy.
Not stealing imaginary property, smoking in a bar, drinking outside a bar, making juvenile jokes on an airplane...
The problem is, there's still a nonzero number of people who are most likely not on the NSA's payroll, who are reviewing every line that comes in, and who may help reject a given patch if it can't be understood.
So yes, it's possible, but it's considerably harder -- you not only have to ensure that it's obfuscated, you have to ensure that it looks like it's not, that it appears to do something benign instead.
And you can't simply do that by adding complexity -- after all, the more complex it is, the more scrutiny there will be, and the more attempts at refactoring it down to manageable size.
No, it would be far easier for them to infiltrate a distro, like, say, Ubuntu. But there are countermeasures to that -- you can always download the source and compile it yourself.
Technically, you cannot be sure that everything isn't completely compromised already -- perhaps anything that looks like a compiler is subtly modified to spit out trojan'd code, and anything that looks like a decompiler or a disassembler is similarly rootkitted. However, this would be an enormous amount of work, and the cracks would very likely show eventually.
The scariest way would be to do it in hardware, but I'm not sure how feasible that is.
Don't thank God, thank a doctor!
Because the minix kernel doesn't do squat useful. So you need an application to do that. And the application will need to be bigger, more monolothic and easier to pwn like this because you haven't got the capability in the kernel.
Nice job.
That is an arms race which doesn't end, though -- how do you know you can trust icc, either? How did you obtain it in the first place -- did you download it and compile it with your own gcc?
Suppose you downloaded a trusted binary -- alright, how do you know you aren't rootkitted, with something which checks a predefined list of compilers, and thus modifies icc again?
Granted, it becomes unlikely. It is, however, impossible to ever truly know. Your method could prove that you are compromised, but it cannot prove that you are not compromised.
Don't thank God, thank a doctor!
Besides, what kind of "evidence" could you trust in a machine that's been well and truly owned, especially if it's playing puppet to a criminal botnet?
Having worked somewhere where a server (not one of mine, but one setup by a contractor) was owned in short order, I can attest to the fact that once that happens you have very little ownership or control of the content on that box. That particular one (a WinNT box) couldn't even *delete* the files that had been uploaded due to issues with the character-set used in filenames, and some of the filenames were very disturbing as to what content they might have had...
I'd say that arresting somebody based on files on a box they *know* somebody else likely had control of is a pretty weak case.
Slashdot will NEVER be considered a legitimate source of "journalism", and why reputable news reporting outlets will regard /. as a nerd/geek/weirdo tecchie haven not to be confused with, say, other tech coverage outlets.
Shouldn't it be infuriating, outrageous for reports to be willfully or negligently taken out of context? Or, is this, alas, what it takes to lure readers, so that VA or /. can garner ad revenue?
I wonder if the incoming administration will -- while not addressing the content of readers -- impose upon site administrators who repost or repurpose non-original material to not use free speech to jingoistically or confusingly restate news. It shouldn't *take* a tech-savvy White House to impose such "suggestions". Hell, VA (not Langley, but the site holders, lest there be confusion, hehehe) should impose it.
Me, i find there to be a woeful lacking in the vetting of posts that get "outed".
(Speaking out to damage my Karma a little more every time...)
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
From TFA: "In a statement outlining the strategy the EU claimed "half of all internet crime involves the production, distribution and sale of child pornography"
What? Half of all internet crime??
Hmmm. Bullshit detector's gone off the scale on this one. I think this is the work of industry lobbyists playing the child porn card to sell snakeoil to clueless, greedy politicians.
"And the meaning of words; when they cease to function; when will it start worrying you?"
Absolutely! never trust any binary! I, of course, have designed my processor from scratch to run straight-up c++. No binaries for me!
(I have designed my own processor, and frankly, getting it to run 8 instructions was more than enough for me, lol)
And over there we have the labyrinth guards. One always lies, one always tells the truth, and one stabs people who ask t
So, in short, here's just one more compelling argument for ditching Windows for Linux...
With more and more Linux users running proprietary binary blobs for convenience reasons or just out of pure laziness (video drivers, flash players and what not), it would be rather easy for $GOVERNMENT to remotely substitute one of those blobs with a "policeware"-augmented one with a classic man-in-the-middle attack. How could you check the code of those binary blobs to be sure that $THEY aren't already listening in when there is no source code to check?
cpghost at Cordula's Web.