European Police Plan to Remote-Search Hard Drives

Smivs points out a blandly-worded story from the BBC with scary implications, excerpting "Remote searches of suspect computers will form part of an EU plan to tackle hi-tech crime. The five-year action plan will take steps to combat the growth in cyber theft and the machines used to spread spam and other malicious programs. It will also encourage better sharing of data among European police forces to track down and prosecute criminals. Europol will co-ordinate the investigative work and also issue alerts about cyber crime sprees."

Comments

lol

[snarfies]

Wow, good thing I have a firewall, built right into my router.

Re:lol

[clam666]

That's funny. I tend to keep my highly illegal terrorism-and-kiddie-porn related files on disconnected usb drives.

Bogus statistical claims.

[VShael]

In a statement outlining the strategy the EU claimed "half of all internet crime involves the production, distribution and sale of child pornography".

And the other half is copyright infringement?

Re:Bogus statistical claims.

[sakdoctor]

I get MY statistics from /dev/random
Oh look, IE usage has dropped to less than 1% and the US is no longer in debt.

This can't be right

[Thelasko]

What it sounds like to me is that police departments will be able to search other police departments' computers. Not police searching civilian computers. The whole article is vague by using the term "remote searches" and not giving any more explanation.

Wow!

[gstoddart]

You know, it's awfully hard to not be yet again reminded of Orwell here. Constant surveillance and no privacy from the government so they can monitor everything you do.

But, of course, if your machine is behind a firewall, they'll just outlaw having firewall because it impedes their ability to investigate you for crimes. At which point if you need to be insecure enough to ensure that law enforcement can get in and do this, your machine will be hosed within the hour as the actual bad people break through as well.

This will either fall apart as un-doable, or spark some absurd laws to enforce it.

Cheers

Re:Wow!

[TripMaster Monkey]

If you don't care for that analysis, here's another.

More Information?

[TripMaster Monkey]

Unfortunately, the article cited is maddeningly vague as to how this initiative will be implemented. A little digging turns up this Register article on the subject, which contains slightly more info.

From the Register article:

In practical terms, remote searches would involve planting law enforcement Trojans on suspects' PCs. Police in Germany are most enthusiastic about pushing this tactic, the sort of approach even Vic Mackey from The Shield might baulk at, despite its many potential drawbacks, highlighted by El Reg on numerous occasions.

For starters, infecting the PC of a target of an investigation is hit and miss. Malware is not a precision weapon, and that raises the possibility that samples of the malware might fall into the hands of cybercrooks.

Even if a target does get infected there's a good chance any security software they've installed will detect the malware. Any security vendor who agreed to turn a blind eye to state-sanctioned Trojans would risk compromising their reputation, as amply illustrated by the Magic Lantern controversy in the US a few years back.

Then there are the civil liberties implications of the approach and questions about whether evidence obtained using the tactic is admissable in court.

Despite all these problems the idea of a law enforcement Trojan continues to gain traction and could become mainstream within five years, if EU ministers get their way.

So, in short, here's just one more compelling argument for ditching Windows for Linux...

Re:More Information?

[dunkelfalke]

thank german minister for the interior for that shit. he introduced the law, the law was modded down by young social democrats, he was pretty pissed and so he tries to push the law through this way.

Worried?

[seanellis]

I would be worried that this would be badly worded and over-broad.

But, being a citizen of the UK, I know that even if legislation were made like this, then Her Majesty's Government would never abuse its powers and apply it to situations which were not originally intended.

Just like the anti-terrorism legislation.

Oh, hang on...

Re:how how how?

[TripMaster Monkey]

how would this work?

Please see my earlier post regarding this...apparently, they plan to infect your system with a remote access Trojan.

But don't worry...it's for your own good.

Go ahead

[Roland Piquepaille]

as I sit here in a cafe, my laptop connected to some unsecured AP far awqay with a biquad wifi antenna, I say go right ahead, search my hard-drive, but don't forget to bring a good map and a gonio antenna to find me in case you realize I'm not the poor guy whose house you're about to raid.

This will never work, there are way too many anonymous internet connections around for this 1984 scheme to work, and people who have something to hide usually don't leave stuff hanging around unencrypted on their hard disks.

Re:All the more reason...

[dkleinsc]

Even visible source code isn't entirely safe:
http://cm.bell-labs.com/who/ken/trust.html

Always a fun read.

Disconcerting possibility:

[fuzzyfuzzyfungus]

If the police are planning to "remote search" hard drives, they'll need something on the client that lets them do so, along with some sort of command and control/results reporting channel between the client and the (totally secure and definitely not going to get breached in an embarrassing display of incompetence that will go utterly unpunished) police HQ.

In the short term, that means some flavor of spyware. The disconcerting bit, though, is that said spyware would look and act like normal spyware; but be part of a police investigation. Generally, interfering with those is a crime. Will removing that spyware be considered obstruction of justice? Will blocking its operations or reporting be considered obstruction of justice? "Your honor, the defendant did maliciously configure his router to drop outbound justice on port 315..." In order to be effective, spyware has to be covert and subtle, so it will be damn difficult to distinguish fedware from ordinary spyware.

Worse, of course, is the medium to long term: if "remote search" is the law of the land, it will soon enough seem like a good idea to mandate a few features from hardware and software manufacturers to make it easier. Make an antivirus program? Well, you'd better be sure that it ignores the activities of any app signed by $AUTHORITY, if you want to stay out of jail. OSes could easily do similar things with process listings, priviledge escalations and the like. Even hardware could get in on the act. In principle, you could build obedience to cryptographically signed orders into all sorts of devices. This would be bad in all the ways that DRM usually is, only worse.

Unfortunately, this sort of turn doesn't seem entirely unlikely. Digital surveillance is all the rage these days, and unlikely to get any less popular, and there are few jurisdictions that have any terribly encouraging history of resisting it. Specifically, the EU has comparatively strong privacy legislation; but it is written from the basic philosophy that privacy is having the state control other's access to the data it collects, rather than privacy being having those data never collected. The US is stronger on that score(at least in theory, and as long as drugs, kiddie porn, and terrorism aren't involved); but the state of private sector privacy is absolutely miserable and there is nothing stopping the state from simply buying surveillance from said private sector(which it indeed does, on a fairly massive scale).

Re:Go right ahead....

[HappySmileMan]

If they search your /dev/random long enough they'll eventually find kiddie-porn so the joke's on you.

Enjoy prison

Re:yeah

[TripMaster Monkey]

because with the government there is accountablity, responsilibty, a paper trail, transparency

Indeed...one need only look at the last eight years in the U.S. for the proof of this statement.

Oh, wait...

Re:Oh that's just perfect!

[Hellahulla]

With mild encryption so it gives them some time to kill.
Could be fun, could also backfire, I mean if they are allowed to do this they'll eventually be allowed to arrest you for wasting their time by doing something like that.
Blah.
I'm moving to Russia.

Re:propaganda and hysteria works both ways

[ODiV]

now in europe, this is exactly what they are going to do: shut down zombies, shut down spam relays, and everyone on slashdot babbles incoherently about teh ev1l gubmint invading our computers.

You've got the eighth comment! And judging by the length of your comment you probably didn't even see half of the previous ones before you posted.

if you instead spastically flail out everytime someone words an article in a propagandistic manner

Oh hi.

Re:All the more reason...

[betterunixthanunix]

The Linux kernel is enormous and monolithic, which is why it is vulnerable to that sort of activity. But a smaller, microkernel design like Minix is easier to inspect, for those who have the time to do so. If you are truly concerned about people sneaking code into your OS, your best bet is to go with a microkernel and put in the effort to inspect that kernel and any relevant drivers; if you do not have that time, then you just need to trust others to do the inspecting for you.

Re:Go right ahead....

[BradleyUffner]

If they search your /dev/random long enough they'll eventually find kiddie-porn so the joke's on you.

Dude, I am so spending tonight checking /dev/random to see if Half Life 7 has been releasd yet :)

Re:All the more reason...

[gstoddart]

The Linux kernel is enormous and monolithic, which is why it is vulnerable to that sort of activity. But a smaller, microkernel design like Minix is easier to inspect

Oh, the irony of this is hilarious. Linux is now more cumbersome to work with than the operating system which caused Linus to write the Linux kernel in the first place. I'm sure Tanenbaum will be proud that he's come full circle. :-P

Besides, all of the stuff one layer up from the microkernel would still need to be checked for security, so I don't really think it buys you anything. The operating system is more than just the kernel.

Cheers

Summary is confused as usual

[Xest]

The summary takes the decision somewhat out of context.

They're not planning to remotely connect to any old joes computer they can and search it, they're planning to connect to zombie computers that have been hijacked by criminals to try and trace back where the criminals are coming from.

Apparently, there will be strict rules on what they can do on said machine too, that is, they're not allowed to start rummaging through people's personal data. Don't think I'm naive by saying that- I'm just repeating what I read on the issue, I don't believe for a minute those rules will be enforceable and I truly think as soon as they have access to these machines and their boss aint looking they're going to start rummaging like crazy.

I'm not sure how I feel about the general idea, if a machine has a backdoor and they can manage to connect to it also then in a way I feel they should just temporarily patch it for the user and inform the user at absolute worse although I'm not sure this is ideal- what if they patch some security researcher's honey pot for instance!

It certainly concerned me a bit when I read it but it's certainly not a plan to just use 0-day exploits to connect to everyone and anyone's PC or anything.

Re:Summary is confused as usual

[ShieldW0lf]

Someone in the arts or business is permitted to think 'The chances of that happening are remote, therefore it is unlikely, therefore I will ignore it. If it should arise, I'll see it and deal with it then.'

People in a technical disciple are obligated to think 'The possibility of that happening is there, therefore it is inevitable that it will happen, therefore the whole thing is wrong until I address it.'

Re:Summary is confused as usual

[cicho]

You are wrong. First, because yes, people will risk their careers to snoop on the privacy of total strangers, just because they can. Since they work in secrecy, it's even debatable if they feel their careers at at risk for doing so: http://abcnews.go.com/print?id=5987804

Second, because as alarming as the linked story is, privacy is ultimately not about the police reading your shopping list. It's always about money - the money someone is willing to pay to access personal data on a political opponent (to discredit her or him), a dissident group (to penetrate and spy on them), or a competing business (obvious).

Therefore, it's also about human rights.

Once the technology is available, it *will* be abused, and we know this, because such abuses have always happened. I don't know of a government (or a business) that had a technology available and decided not to use it because doing so would be unethical or even illegal. How many times must the same stories repeat before we learn?

Re:Summary is confused as usual

[Stanislav_J]

Once the technology is available, it *will* be abused, and we know this, because such abuses have always happened. I don't know of a government (or a business) that had a technology available and decided not to use it because doing so would be unethical or even illegal. How many times must the same stories repeat before we learn?

An old saying puts it best: "What the government wants to do, and has the means to do, it will do -- logic, ethics, and common sense notwithstanding."

Re:yeah

[Smauler]

A grey hat in his basement can give me a trojan, perhaps fuck up my computer. The government can send hordes of armed men round to my house and lock me up for the rest of my life. Although I do probably trust the government more than some random, I know which one I am more scared of.

You just moved the problem

[Anonymous Coward]

Because the minix kernel doesn't do squat useful. So you need an application to do that. And the application will need to be bigger, more monolothic and easier to pwn like this because you haven't got the capability in the kernel.

Nice job.

HALF of all net crime is child porn???

[gilgongo]

From TFA: "In a statement outlining the strategy the EU claimed "half of all internet crime involves the production, distribution and sale of child pornography"

What? Half of all internet crime??

Hmmm. Bullshit detector's gone off the scale on this one. I think this is the work of industry lobbyists playing the child porn card to sell snakeoil to clueless, greedy politicians.

Re:All the more reason...

[codemaster2b]

Absolutely! never trust any binary! I, of course, have designed my processor from scratch to run straight-up c++. No binaries for me!

(I have designed my own processor, and frankly, getting it to run 8 instructions was more than enough for me, lol)