Slashdot Mirror
EFF Warns of Harsher CFAA (eff.org)
An anonymous reader writes: The Computer Fraud and Abuse Act is "vague, draconian, and notoriously out of touch with how we use computers today," warns the EFF. But instead of reforming it, two U.S. Senators "are on a mission to make things worse..." The senators' proposed Botnet Prevention Act of 2016 "could make criminals of paid researchers who test access in order to identify, disclose, and fix vulnerabilities," according to the EFF. And the bill would also make it a felony to damage "critical infrastructure," which may include software companies and ISPs (since they're apparently using the Department of Homeland Security's definition).
The harsher penalties would ultimately give prosecutors much more leverage for plea deals. But worst of all, the proposed bill even "empowers government officials to obtain court orders to force companies to hack computer users for a wide range of activity completely unrelated to botnets. What's worse is that the bill allows the government to do this without any requirement of notice to non-suspect or innocent customers or companies, including botnet victims... These changes would only increase -- not alleviate -- the CFAA's harshness, overbreadth, and confusion."
The CFAA was originally written in 1986, and was partly inspired by the 1983 movie "WarGames".
The harsher penalties would ultimately give prosecutors much more leverage for plea deals. But worst of all, the proposed bill even "empowers government officials to obtain court orders to force companies to hack computer users for a wide range of activity completely unrelated to botnets. What's worse is that the bill allows the government to do this without any requirement of notice to non-suspect or innocent customers or companies, including botnet victims... These changes would only increase -- not alleviate -- the CFAA's harshness, overbreadth, and confusion."
The CFAA was originally written in 1986, and was partly inspired by the 1983 movie "WarGames".
Sens. Sheldon Whitehouse (D) and Lindsey Graham (R). Remember that "bipartisanship" is a Newspeak term that roughly translates to "Two sides of the same coin double plus good".
You all know what needs to be done.
“He’s not deformed, he’s just drunk!”
Registration of security researchers
Security researchers provides a valuable service. Why not establish a professional association, establish codes of conduct, and a method to register professionals. These professionals could submit proposals for pen testing, security scans, etc. to the professional organization and they would be held in private from others. In the event an incident comes up the government would contact the professional association and they would check if a registered professional is doing research on said network.
Question for 100: How would you become such a professional? It's not like you're born a hacker, ya know...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The problem I see with this is that sometimes security vulnerabilities are accidentally found by people that aren't even looking for them. Such a person should be able to report the vulnerability without fear of legal reprisal, but the current legal landscape makes that impossible.
Intelligent responses welcome, flames will be met with marshmallows.
We've got all that and more.
Call it..
"NSA"
could make criminals of paid researchers who test access in order to identify, disclose, and fix vulnerabilities,"
Laws don't work that way. If a prosciutto.. I mean prosecutor says it does they can eat it. Surely a contract for penetration testing will be legal even if this law goes through.
And the bill would also make it a felony to damage "critical infrastructure," which may include software companies and ISPs (since they're apparently using the Department of Homeland Security's definition).
Is this a bad thing somehow? Apprehending those copper thieves finally gets easier.
Question for 100: How would you become such a professional? It's not like you're born a hacker, ya know...
If this association is like the CISSP it is incestuous in the sense the only way to become a member and become certified is to already work for a current CISSP member for a certain number of years. Again the chicken and egg problem raises its head. I have worked with certified professionals who were worse than useless.
While I see your point, the original poster's conclusion is still a valid one. A professional organization, like ASME, ASME, IEEE, etc, would be able to write a code of ethics, provide lobbying support so legislation like this would have at least some opposition, and go to bet for security researchers. In a mechanical and systems engineer, and a member of ASME and INCOSE. I rarely use the resources they provide (the free magazines have some interesting articles every once in a while) but I understand that their biggest advantage is looking after the interests of engineers like me. Networking is also a big part of being a member.
Professional organizations have a way of benefiting everyone in the field, not just members.
This is just another tool to use against people that the authorities don't like. This gives them another peg on which to hang you.
Perhaps your fiddling around on the net probing stuff or finding a vulnerability on a website wasn't explicitly a crime before, but now....now it is. And the penalties will be harsh, count on it. Expect the word "terrorism" to be in there somewhere as well.
Just cruising through this digital world at 33 1/3 rpm...
Unless we make Oritz and her family life hell, nothing will change. Enact just punishment. Make her life hell. Or nothing will change, they will not fear us otherwise.
Yep, same shit, different year. Back in the 1990s, Clinton was pushing for the CDA to get passed, and first drafts of the law would make the sender, receiver, and every node/ISP/network provider in between all arrestable for 2-10 if someone decided to E-mail the word "fuck" across the Internet. There was the DMCA fight, which the EFF rolled over on.
The sad thing is that it was China and Russia which vetoed SOPA/PIPA. They made is clear that blocking a site on their soil would be similar to a naval blockade... i.e. an act of war, and would be retaliated against as such.
The only good thing that the Dems do is try to bring the US into a modern age... True patriots like the Dem from Rhode Island have put in bill 4269 which bans all assault weapons, so we can join Australia in the modern age, free from school shootings on a daily basis.
TLDR: You can't control an innocent man.
"...much more leverage for plea deals..."
The 'rule of law' means that the law is supreme. Not the guy wearing the uniform that week or the guy sitting in the oval office that year or the guy wearing the robe. The rule of law is meant to keep the *person* charged with the duty to serve the public from abusing the power they were given along with that duty.
This is the point, right here. Making 'hacking' 'security research' or even ordinary computer use illegal is not the point. The point is to make *everything* illegal. Nobody, including law enforcement, gives a rat's butt whether you abused or frauded a computer or if you botted a net.
Law enforcement knows who the bad guys are, they always have--it's their job. The problem is all these civil liberties and protections for the accused make their jobs--protecting you--damned near impossible.
Solution--you're all criminals. We've got a job to do, and we understand you don't like part of it. Maybe part of it is you paying a fine, turning over some information, or even going to jail. You're going to do it because we--the people who protect you from the bad guys--have fucking told you to do it.
Now--if you want to challenge our lawful orders or appeal to a higher authority, call a lawyer, stand in front of a judge, or whatnot, let us show you what you're guilty of. Here's a *long* list we just put together without even trying. And here's the time you're going to get behind bars if you DO push the issue.
You're guilty. If you want to stay out of jail, just let us take what we need in order to do our jobs protecting you. When we're done you can get back to your life. And you can keep your mouth shut if you don't want to see us again.
Because we're just here to protect you.
"Reality is that which, when you stop believing in it, doesn't go away." - Philip K. Dick
The bill includes this definition of "critical infrastructure":
"(2) the term âcritical infrastructureâ(TM) means systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have catastrophic regional or national effects on public health or safety, economic security, or national security."
You may not be aware of this, but the bad guys often aren't under U.S. jurisdiction and wouldn't care if they were. I guess it's better just to leave knowledge of vulnerabilities to them alone.
Should be illegal.
They smell of inquisition methods of extracting confessions.
You only get 2 years prison if you confess to such and such. And we forget about the rest.
Well, color me surprised that our elected representatives are such clueless dipshits that they'd take a Hollywood movie as an accurate representation of reality.
A person with an IQ of 40 can hold office, no experience needed.
Given the amount of toilet paper hanging behind me in nice frames in my office and me being probably the worst in the team when it comes to pure hacking know-how (pretty much the proverbial parrot joke, "we have no idea what tricks this bird can do 'cause he never talked, but the other two call him boss in 4 different languages"), I can't help but agree.
There are a few certificates that actually show off what you can or can't do, but most are just like you say, mostly proof that you've been in the industry for a while and went to some circle-jerk events.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
"violating or about to violate section 1030(a)(5) of this title where such conduct has caused or would cause damage"
You don't have to commit a crime under this bill, you only have to be accused of preparing to commit a crime.
tldr: don't feed the trolls.
The primary function of BS in a debate is not to convince the audience (the fear the opponent's BS will convince the audience is bait for the primary purpose). The primary function is to get you to waste your attention and the audience's patience with you.
It's just rope-a-dope.
"Reality is that which, when you stop believing in it, doesn't go away." - Philip K. Dick