Slashdot Mirror
EFF Warns of Harsher CFAA (eff.org)
An anonymous reader writes: The Computer Fraud and Abuse Act is "vague, draconian, and notoriously out of touch with how we use computers today," warns the EFF. But instead of reforming it, two U.S. Senators "are on a mission to make things worse..." The senators' proposed Botnet Prevention Act of 2016 "could make criminals of paid researchers who test access in order to identify, disclose, and fix vulnerabilities," according to the EFF. And the bill would also make it a felony to damage "critical infrastructure," which may include software companies and ISPs (since they're apparently using the Department of Homeland Security's definition).
The harsher penalties would ultimately give prosecutors much more leverage for plea deals. But worst of all, the proposed bill even "empowers government officials to obtain court orders to force companies to hack computer users for a wide range of activity completely unrelated to botnets. What's worse is that the bill allows the government to do this without any requirement of notice to non-suspect or innocent customers or companies, including botnet victims... These changes would only increase -- not alleviate -- the CFAA's harshness, overbreadth, and confusion."
The CFAA was originally written in 1986, and was partly inspired by the 1983 movie "WarGames".
The harsher penalties would ultimately give prosecutors much more leverage for plea deals. But worst of all, the proposed bill even "empowers government officials to obtain court orders to force companies to hack computer users for a wide range of activity completely unrelated to botnets. What's worse is that the bill allows the government to do this without any requirement of notice to non-suspect or innocent customers or companies, including botnet victims... These changes would only increase -- not alleviate -- the CFAA's harshness, overbreadth, and confusion."
The CFAA was originally written in 1986, and was partly inspired by the 1983 movie "WarGames".
Sens. Sheldon Whitehouse (D) and Lindsey Graham (R). Remember that "bipartisanship" is a Newspeak term that roughly translates to "Two sides of the same coin double plus good".
You all know what needs to be done.
“He’s not deformed, he’s just drunk!”
Registration of security researchers
Security researchers provides a valuable service. Why not establish a professional association, establish codes of conduct, and a method to register professionals. These professionals could submit proposals for pen testing, security scans, etc. to the professional organization and they would be held in private from others. In the event an incident comes up the government would contact the professional association and they would check if a registered professional is doing research on said network.
Question for 100: How would you become such a professional? It's not like you're born a hacker, ya know...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The problem I see with this is that sometimes security vulnerabilities are accidentally found by people that aren't even looking for them. Such a person should be able to report the vulnerability without fear of legal reprisal, but the current legal landscape makes that impossible.
Intelligent responses welcome, flames will be met with marshmallows.
This is just another tool to use against people that the authorities don't like. This gives them another peg on which to hang you.
Perhaps your fiddling around on the net probing stuff or finding a vulnerability on a website wasn't explicitly a crime before, but now....now it is. And the penalties will be harsh, count on it. Expect the word "terrorism" to be in there somewhere as well.
Just cruising through this digital world at 33 1/3 rpm...
TLDR: You can't control an innocent man.
"...much more leverage for plea deals..."
The 'rule of law' means that the law is supreme. Not the guy wearing the uniform that week or the guy sitting in the oval office that year or the guy wearing the robe. The rule of law is meant to keep the *person* charged with the duty to serve the public from abusing the power they were given along with that duty.
This is the point, right here. Making 'hacking' 'security research' or even ordinary computer use illegal is not the point. The point is to make *everything* illegal. Nobody, including law enforcement, gives a rat's butt whether you abused or frauded a computer or if you botted a net.
Law enforcement knows who the bad guys are, they always have--it's their job. The problem is all these civil liberties and protections for the accused make their jobs--protecting you--damned near impossible.
Solution--you're all criminals. We've got a job to do, and we understand you don't like part of it. Maybe part of it is you paying a fine, turning over some information, or even going to jail. You're going to do it because we--the people who protect you from the bad guys--have fucking told you to do it.
Now--if you want to challenge our lawful orders or appeal to a higher authority, call a lawyer, stand in front of a judge, or whatnot, let us show you what you're guilty of. Here's a *long* list we just put together without even trying. And here's the time you're going to get behind bars if you DO push the issue.
You're guilty. If you want to stay out of jail, just let us take what we need in order to do our jobs protecting you. When we're done you can get back to your life. And you can keep your mouth shut if you don't want to see us again.
Because we're just here to protect you.
"Reality is that which, when you stop believing in it, doesn't go away." - Philip K. Dick
The bill includes this definition of "critical infrastructure":
"(2) the term âcritical infrastructureâ(TM) means systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have catastrophic regional or national effects on public health or safety, economic security, or national security."
Surely a contract for penetration testing will be legal even if this law goes through.
Sure, for those few companies that are willing to spend the money to do it. Everyone else would rather pocket that money and plead ignorance to their customers and shareholders.
Please stand clear of the doors, por favor mantenganse alejado de las puertas
Yes, a contracted pentest would still be legal. However, there are many interests where the company will not contract for a pentest or even agree to a free test but exposing their security weaknesses is in the public interest.
Given the amount of toilet paper hanging behind me in nice frames in my office and me being probably the worst in the team when it comes to pure hacking know-how (pretty much the proverbial parrot joke, "we have no idea what tricks this bird can do 'cause he never talked, but the other two call him boss in 4 different languages"), I can't help but agree.
There are a few certificates that actually show off what you can or can't do, but most are just like you say, mostly proof that you've been in the industry for a while and went to some circle-jerk events.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Because regular firearms won't work in schools, only assault weapons. Because... magic?
tldr: don't feed the trolls.
The primary function of BS in a debate is not to convince the audience (the fear the opponent's BS will convince the audience is bait for the primary purpose). The primary function is to get you to waste your attention and the audience's patience with you.
It's just rope-a-dope.
"Reality is that which, when you stop believing in it, doesn't go away." - Philip K. Dick