Slashdot Mirror
Japanese Man Arrested For Storing Malware
Orome1 writes "38-year-old Yasuhiro Kawaguchi is the first person in Japan to get arrested for storing malware on his computer after the upper house's Judicial Affairs Committee has confirmed the new anti-malware law passed by the Japanese parliament. The law considers the creation, distribution and storage of malware a crime punishable with up to three years in prison and a fine that could reach the sum of 500,000 yen ($6,200)."
Surely any "white hat" working against malware needs to store malware someplace, right? What a dumb law.
The article says the charge was "storing a computer virus without a legitimate reason". In this case, the suspect "told the MPD that he did it to punish people who use file-sharing software"; do you consider that "a legitimate reason"?
not dumber than cyber-crime law in other countries. politicans don't understand the whole computer/network thing
The summary is pretty poor (as usual). The article says 'The revised Penal Code, which was enforced July 14, bans storage of a computer virus for the purpose of infecting other computers.' I doubt Symantec or McAfee store for the purpose of infecting other computers.
FTFA:
Kawaguchi uploaded a file containing the virus, which was titled to suggest child pornography, to the Internet via the file-sharing software Share
Well, normally I consider people who upload viruses via file-sharing software to be scum of the earth, but this guy seems like he was actually doing it for a moderately good cause. "Think of the children" is hella over used, malware is malware, and vigilante justice it questionable, but punishing this guy seems kinda weird, especially that strongly. Also, how the hell do they define "storing" malware? Technically, that could mean anyone infected is guilty, which is really scary.
I'm sure it won't be abused, of course. /sarcasm
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
I doubt Symantec or McAfee store for the purpose of infecting other computers.
No, their regular products do that quite nicely, thank you.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
The summary leaves out the important bits like with the intent to infect others.
And while an infected computer would possibly spread that disease, it's certainly not intended by the computer's owner.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The German law is even actually dumber.
If I understood the Japanese law correctly, you'd have to have some kind of intent to use that malware to infect other computers to break it. So far, so good. Personally, I don't see anything wrong with that by itself, creating, storing or distributing malware with the intent to infect should be punishable. I wonder how they want to discriminate between intentional and accidental spreading (after all, it could well be that he himself downloaded that somewhere and didn't even know it's malware), but if they find a way to actually identify the intent of someone, that law could actually do much good.
The German "anti-hacker law" cannot. There is simply no angle or way this could possibly have any beneficial effect. Basically, what the law says is that a "hacking tool" is illegal. There may be an exception for good reason, so far nobody tested it. I actually cannot remember a case where it was used. And it's sufficiently ambiguous that a hex editor could be subject to it or a firewall that lets you configure the packets it replies with. But let's stay with nmap, hping and all the other "hacking tools" for a moment. These are very well known and quite powerful tools to check the security of a network, so they can be used to find weaknesses in it, hence they're hacking tools.
And auditing tools. Why? Because auditors use exactly the same tools for an obvious reason: Everything you can use to find weaknesses in a network to break into it can also be used to find weaknesses in a network to fix and seal them. Unfortunately, the law makes little difference in intent. Because not the use, but the possession, is already illegal. And when I own a rifle with a scope, it doesn't make any comment yet on whether I go on a killing spree with it or whether I'm a hunter.
Now let's ponder for a moment who gives a shit about a law that makes those tools illegal: An auditor, whose job and pretty much his career hangs on his police record being spotless, or a criminal who plans to commit a crime much more serious than "possession of hacking tools".
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
it is some where alone the lines of breaking your own leg to prevent yourself from getting on a bike, because then you might have a nasty crash and hurt yourself
Technically, though, having a virus-infected PC is both storing and distributing viruses....
But without intent. And someone who is clueless enough to collect active malware on his PC can credibly claim that there was no intention behind it.
I dunno about your courts. Ours follow the logic of "don't assume malice if stupidity is enough of an explanation".
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I ran servers for years and years as a sysadmin, now I run/develop for servers. From time to time this and that gets hacked, most of the time it is just attempts that leave some binaries, sources here and there. I always keep these to see what they do, how they do it and as a reference to any in-the-future attempts to see if a name, email or something pops up again from an older attack. I keep logs, hacked files packaged and usually password protected.
This law is stupid! I 100% agree. Even writing malware is something legit if you do not distribute it. Be it a hobby, a profession, or whatever else.