Slashdot Mirror
Finns Outlaw Virus Writing
Ecyrd pointed out that the Finnish Parliment has ratified an amendment making viruses illegal. It's actually not just illegal to use them - distributing them is illegal as well. The most interesting part of the legislation is that apparently isn't just using them - writing them is also a crime.
Since Finnish is not yet one of the major languages of the world, here's my translation of the relevant section of the new law. I'm not a lawyer or a professional translator, and I'm especially ignorant of English legalese--my apologies for the inevitable errors here. Also, this is only the version proposed by the Government, and the law that was actually approved may be different.
Malicious intent is the most important point; the program can be anything harmful, not just a virus in the technical sense. Also, a guide to writing viruses will qualify.Depending on how they defined virus this law comes awfully close to saying that certain ideas are illegal. Remember that a source for an encryption program was ruled protected speech here in the US, so this law would fall under prior restraint here.
Once again, legislators try to prohibit ideas and information, instead of making their irresponsible or malicious use illegal.
This assumes that no beneficial use for viruses will ever be found -- e.g. security patches that automatically spread and install themselves, or techniques similar to vaccinations where benign viruses are spread to train computer immune systems to attack damaging ones. Not a real issue today, but do we want to assume that it will *never* be an issue?
What they are saying is that whether you knowingly or unknowingly distribute a file with a virus you are liable for the damage that it causes.
Through college I worked my way out of the MIS department of a large company (and into research with another). Most of the people there were computer capable, but not literate. They didn't understand scanning drives, they didn't understand what infected files were and ultimately, they didn't care - until it affected them. It took us almost a year in one case to clean the entire system (child companies in the SW and overseas provided additional problems). We would clean the Servers, and then boom, once again the same files would appear as infected as before. We had to go to over 400 PCs at our location 600 about a 30 miles away, and create simplistic documentation for several other plants, offices and hundreds of field reps to follow. Old virus software detected the problem, informed people of the potential hazzards, but because these things were deemed "mission critical," people stupidly continued to distribute them, download them, work with them, etc...
Blatantly ignoring a problem nearly crippled our company. Even though the people were uneducated about viruses, they made no effort to report problems, viewing this problem as one that would just "go away," like a cold or the flu...
It is vitally important (especially the way the internet is expanding) that people make an effort to take responsibility in cleaning their files, machines and so on.
You say you want a revolution?
People in other countries watch American TV? Must be some new kind of torture..
Besides, neither of the two examples you listed had anything to do with the media. I'm sure a few people outside of the States consider that awful show with Chuck Norris to be some kind of documentary but I, for one, am not buying it.
~ Kish
Think about it. If it's illegal to distribute virii, then it'll be much more difficult for anti-virus software producers to get copies of the virus in order to write an antidote.
Werd.
Wow! I hope they mean INTENTIONALLY transmitting them is illegal...
Otherwise, over 50% of my company will be arrested...! (not me, of course...)
-- You can't idiot-proof anything, because they're always coming out with better idiots.
Isn't this something for YRO? While I despise virus writers as much as the next guy, I find the idea of being forbidden to code something in the privacy of your own system very chilling, in the order of surpressing knowledge/censorship/dystopia.
How will they enforce this law? How will they track down the virus writer?
Some questions for thought.
Ok, so i'm a finn and I can't put my viruses on a finn website. Boohoo, I'll just put them on a geocities website. My plan for a new goverment, is that everyone in a disicion making department must take a test on what they are trying to regulate. Uf they don't pass the test, they don't get to vote.
"The decisive second reading of the Bill cites the offence as a catch-all "Causing danger to data processing systems". Under the terms of the new law this will be punishable by fines or by prison terms of up to two years. It is hoped to get the amendment into law as quickly as possible."
Maybe Linus moved to the U.S. because he peered into the future and knew this was coming.. Or, ah, maybe not.. Soo! Is it just me, or could just about any program "cause danger to data processing systems"? Does this thing have a provision for whether or not it was even intentional!? I mean, what if what you have is a program with a bug in it? Even if you didn't mean for the program to have a bug, before you even get it through the debugger you've committed a crime! At least, that's how it appears from that article. If I were Finnish, I'd be moving out of the country or giving up the idea of becoming a programmer. Ha!
~ Kish
So, is playing core wars now illegal? Sometimes writing malignant programs attempting evolution on one's computer (or network!) is a great way to learn about logic, memory protection, and security. If one cannot experiment in their own room on their computer legally, there will be either secrecy or a bunch of mouse pushers come next decade.
HELSINKI (Reuters).
In a surprise move, an arrest warrant was issued by the Finnish police to capture Linus Torvalds under the nation's new "anti virus" law.
"The law states that any program that causes danger to data processing systems and is freely available for download by visitors is a virus," said Lt. Hakk Daeta. "The linux kernel poses a danger to Windows, which is a widely used data processing system. Many legal scholars have testified to this. And after Torvalds blatantly put out this virus, millions of PCs have been affected. He must be stopped."
Meanwhile, rumors persisted that Torvalds was seen on the Jerry Springer show, on an episode titled "My PC is too sexy". A man who appeared on the show wearing a paper bag over his head made the suspicious statement that "I am innocent. I just showed how it must be pronounced. It is lin-nucks, not line-ux."
Police are still searching.
Core wars is about writing programs in redcode that attack each other. This is different from a virus which straps onto another program and replicates, often killing the host in the process, much like a virus that would attack a human. Okay, perhaps there is a fine line between these two, but here are some major differences between redcode programs and real programs:
1) redcode isn't a real machine language (or at least I don't know of any chips that understand redcode), so a virus-like program in redcode can't damage anything.
2) most real computers don't have 10000 or so bytes of circular memory.
3) if a redcode program could be ported to a real computer, it would simply crash the machine or be halted by the OS for violating memory protection.
4) most modern computers don't have instruction sets that include "mov 0 1" and the like -- making it difficult to port even the simplest of recode programs, the imp.
My plan for a new goverment, is that everyone in a disicion making department must take a test on what they are trying to regulate. Uf they don't pass the test, they don't get to vote.
I want something similiar. I want the "enlightened democracy" where everyone that wants to vote (for parliament, etc.) need to go through a test - to show that they know what they're voting at. 50 or so questions about what diffrent parties want. If you get more than 75% correct, you may vote. If not, you may go home and rehurse, and come back and take the test again.
The point is - nobody is going to be *excluded*. There should not be "right" and "wrong" meanings. The point is that people should know what they're voting at.
--
"Rune Kristian Viken" - http://www.nwo.no - arca
This new law raises intersting topic for debate. Here, we see that the government has banned the production and distribution of "something" that has, traditionally, been used for malicious and/or damaging purposes. Fairly straightforward.
However, upon closer inspection, we find an inherant flaw - what constitues the now "illegal" viral code? A somewhat sesible definition of a virus, can be found at "whatis.com/virus.htm". The key point in any defintition seems to be : "A virus is a piece of programming code inserted into other programming to cause some unexpected and, for the victim, usually undesirable event.". Again, decent enough.
However, what about "software patches" ? Upgrade packs, the (in)famous Microsoft "Service Packs", and the like? Generally speaking, the user doesn't really have any clue how, or what, these are doing - beyond "fixing broken things". These patches insert their code into the parent program, usually modify the behaviour of the program in some way, and sometimes result unexpected results (option removed, feature added, etc..). That's all the criteria of a virus, right there. Should these be illegal also?
Back the the first point - we see the government trying to protect its people by banning "something" - specifically, in this case, viral code. Why this, and not many of the other "things" that are (primarly) harmful? The obvious selection - firearms. Why not ban guns? Or biological weapons facilities (most industrialized "1st world" companies have them, in some capacity)?
If we'd like to get a little paranoid/"Evil Future Governement" about it, we could go as far as to speculate that the government can (and will) start to ban all manner of things it considers "bad for you". Meat? Cow Milk? Free Speech? Ah, the wonders of Totalitarian government.
By now, many of you might be thinking "man, this isn't the x-files, our government won't go THAT far". Yes, you're probably right.. of course, you don't code viruses...
.------------ - - -
| big bad mr. frosty
`------------ - - -
windows is not a virus. A virus actually does what it was intended to do, usually quite fast and efficient.
No one can understand the truth until he drinks of coffee's frothy goodness.
--Sheikh Abd-Al-Kadir, 1587
It's even possible that virus pertained not to the second but to the fourth declension, which would change the matter as well.
The word becomes invariant in most modern languages, but for some reason, English elected these viruses rather than *these virus as one might otherwise expect from the modern Romance tongues.
You can read Far More Than Everything You Ever Wanted to Know about The Plural of Viruses if you'd like.
Calm down.
The article very clearly says:
"The intention to harm becomes the primary criteria for bringing charges". The primary criteria. I also verified this from the finnish (paper) version.
It is not enough to bring up charges if you just distribute a virus, there must be proof of intention to harm. Before this law, you could've spread a nasty virus to every single PC in Finland, but if the authorities found it a couple of days before the activation date and all the viruses were killed, you could have walked out with no charges.
Kinda like if someone's threatening to kill you, and the police tells you to call back when you're dead, because there is no law making anything else than murder illegal.
Thanks much, of course, for the Kudos. I got marked redundant, which wasn't true when I was writing the post, only after it showed up. But oh well.
I think the "Intent to do harm" phrase is not regarding the virus code itself, but rather the mindset of the creator. This is, of course, much harder to prove than the former case, but it makes a whole lot more sense. My guess is that there was never a plan to punish people for having malicious code on their machines *unless* it was freely available for download or they intended to use it in a naughty, naughty way. This negates the worry that an AV researcher's code will cause them to be convicted, since I think lots of people here are slightly misreading the article. Malicious code is fine to have on your computer, as long as you don't distribute it and don't intend to use it to do harm to a machine that is not yours!
Intent is always a hard thing to prove, which is why so many murders get reduced to manslaughter on the bargaining table: the DA can never be sure he's going to convince a jury. The same trouble will show up here, I believe, and we'll probably see a few cases where the perpetrator gets a plea bargain, simply because the evidence of intent is not present, but it is frighteningly clear that that was the intent (from a handle like "My_ViRuZ_WiLL_oWN_yOO" or something along those lines.)
Anyway, some people may think that this is a rights violation against the Finnish people, but I can't agree. Of course I'm one of those "gun control nuts" as well.
Regards, and I'm sorry if this strikes you as a rant,
-efisher
---
this
Slight exaggeration doesn't even -begin- to cover what you said in the first paragraph if you are talking about the U.S. heh. More like some things blown wildly out of proportion and others total fabrications. :) Makes me wonder what sort of things most people -really- think about the U.S., since I know a lot of total -fools- who think we still ride horses to school/work in Texas. Gaahh! The idiocy.
My making light (that is, making humorous [!?] comments) about the subject is my usual style of reaction with regards to something so patently ridiculous as that law seems to be from what that article suggested. To be honest, I wouldn't move or give up programming, I'd try to get the law changed. At any rate, if that article is indeed accurate as far as that goes, "suck" doesn't even -begin- to describe that law.
And yeah, even though your comments in your first paragraph were a little "off", every country has a good number of incredibly stupid laws, past and present (ugh.. CDA.. blah!).
~ Kish
Vandal: "I wasn't vandalizing his car, your Honor, I spray-painted it as an expression of my artistic individuality."
Judge: "Case dismissed."
Every human endeavor can be justified by someone. Yes, there might be some legitimate reason to write a program which formats the hard drives of complete strangers, but I'm sure the Unibomber felt justified, too. I know, it is very popular to bleat about any percieved limitation of human rights, but can't you resist the temptation once in a while and use your brain instead?
Remember that to the Iraqi government, one of their nationals who wrote a program which attacked all *.gov addresses would be a freedom fighter. To us, he would be a terrorist. No, I really don't care that someone sits in the privacy of their own home and write virii with incredibly destructive potential. I guess it is good intellectual exercise. However, if that virii gets distributed, intentionally or otherwise, then the author should face the consequences.
'But your Honor, I didn't mean for the super-toxin I formulated in my kitchen to escape into the outside world and poison millions of children. I designed it to kill rats in my cellar. Honest!"
"Case dismissed."
And do you know what? Even if the Finnish law does criminalize the mere writing of virii or trojan horses, I don't care, either. It is against the law to build bombs in your basement, as well. "But I need the intellectual exercise! My cerebral cortex was getting flabby!" Read a fucking book. The library is full of 'em.
Lastly, no one will KNOW that you are secretly concocting virii or trojan horses in your basement if you don't distribute them. If you are breaking the law and are such a dork that you are publicizing the offense, you deserve what happens to you. "But it is my RIGHT to distribute the fruits of my intellectual endeavors!" Or: "It is for educational purposes only!" Yeah, right. And the links to cracks on www.astalavista.box.sk aren't really intended to be used by anyone. How about putting a bowl of poisoned Snickers in a busy shopping mall. Put a big sign above it that says "DO NOT EAT - DEATH WILL RESULT IMMEDIATELY." Put it in multiple languages. I'm sure the judge will be lenient when you explain that it wasn't YOUR fault that anybody died. You were merely the distributor, and you DID put a disclaimer!
Neopets - the best free game on the Int
Helsinki News Service: "Man yells fire in crowded theatre, dozens trampled. Government responds by banning use of word 'fire'."
Seriously, my first introduction to virus protections came at a PCUG meeting. The speaker was explaining how to protect yourself against virii. He proceeded to write a virus in ten lines of DOS batch file code. Then he tried to infect the demo computer with it. It failed of course, but seeing exactly how a virus worked was very helpful.
Question is, what possibly criminal act was he committing?
A Government Is a Body of People, Usually Notably Ungoverned
I have a classical citation that shows virus being invariant in the genitive. I challenge you to produce any classical instance of virus in the plural.
Ha! At least I qualify my statements. I never claimed to be some "big expert" in Finnish law.. not like you apparently are in American law.
"In Finland, judges are allowed and _expected_ to use common sense; not a common thing in the States."
That's the ignorant thing I've ever heard in my life (well, not really, but it has some ranking there).. The Judicial Branch of the U.S. government is actually one of the best places to look for intelligent decisions. Can you even begin to /imagine/ all of the idiotic laws the U.S. would have if the Judicial Branch didn't rule against them? Ha! Of course, it seems interesting that the people with the most "well-researched" opinions on American law (or the U.S. in general) can't even speak proper English.
The stuff in between is even less worthy of remark..
"But you're american, and there this kind of thing would surely happen. - USA created Bill, Finland created Linus -"
How in the hell does that register in someone's brain? Is Linus the leader of the Finns? heh. Besides, Linus isn't all that remarkable if you don't consider his programming ability. If not for Richard Stallman (or is he Finnish too? yeah right) Linus wouldn't have had a GCC to play with, would never have thought of something like the GPL (if you disagree on /that/ point, perhaps you should do more research on how their political viewpoints differ as far as software is concerned), and it's really doubtful he'd have put together an entire OS by himself without the help of the FSF. By then we'd all be using some flavor of BSD, anyway. heh! As much as I love Linus, all he is is a really good hacker. We have Stallman to thank for the current state of affairs in the software community, for it was his philosophy, whether you agree with it or not, that set it all into motion. And he's.. oh no! American! He's even an atheist. Scary.
At any rate, the U.S. has many people living in it. Rating an entire country by one person is biggotry of the highest order. I'm moving to Canada.. permanently.. as soon as possible. Why? Because I don't think Canada sucks just because I hate Alanis Morisette. heh!
~ Kish
Alot of the lame trojan virii out there are just regular programs that do funky-ass stuff when you execute them. Does that classify as a virus? They're technically just programs where the does not know the effects of it. When the user is stupid enough to execute something he/she doesn't know the effects of, does that still make it a virus? Most of this I've been assuming is media misrepresentation of the term 'virus'.
Hmm, what worries me is the "no actual damage need be done" part. I think that regualtion of behavior was based on _impact_ to society.
I think all governments would do better to strike laws that regulate non-harmful behavior than to make up laws against behavior that is potentially harmful. Intent is difficult to judge at times. Damage is pretty clear.
That said, my remaining question is: Was it actually legal there to cause harm not _danger_ to data processing systems. Why did they feel the need to pass this law?
--- If you don't want to know the answer, don't ask the question.
This sounds too far reaching. If distribution is illegal then what happens to valid research? Somebody needs to write anti-virus software. What about accidental distribution? If I accidently infect some computers in my workplace and have a troglodyte for a boss could he accuse me of breaking the law and have me carted away? Sure, when it comes to court I'd probably be exonerated but in the mean time my reputation will have been damaged.
Virus distribution should be illegal in the same way vandalism is. You can carry around rocks and bricks without breaking the law, use those rocks and bricks for vandalism and you do break the law.
I really feel a bit strange about this. I think anybody who writes a virus for the purposes of infecting anybody should be locked up, but from an intellectual point of view they're very interesting.
Isn't this partially why we (well, most of us) run an alternative OS, so that virii are not a worry?
.fi, you don't have to really outlaw virii, just outlaw Windows and the virus problem disapears, afterall, only root can truly screw a linux system over...
So you see
I must say that, being a Finn, and having read the original article as well as the legislation proposal in Finnish, you are exactly correct in your interpretation. Seems to me like some 90% or so of the articles for this topic are written based on false assumptions or misunderstanding of what the proposed change to law is about, or actually says.
I did not read the entire proposal in Finish, but it has a quite long discussion about viruses and worms and the current state. There is also a mention that the Netherlands, Italy, Switzerland and Russia have existing legislation about viruses or which can be applied to viruses used for malicious purposes.
I don't have any comments on the subject at hand, i just want to comment their news value.
I happen to live in Finland at the moment and well, im a regular slashdotter. And yes, im a bit amazed to see 2 news headlines about Finland. Well, im not amazed because of the amount of headlines but because of the topics! Man, who reports this stuff ? HPY has been creating this virtual Helsinki for years and making virus distribution & writing them has been a headline aint so new thing at all. IT Media has been talking about this for quite some time now.
Btw, Nokia has prototypes of those 'cellphone-digitv-browser' thingies allready. Someone with a good scanner should post those pics. (Check out last Tietoviikko!)
This is not new in Europe. The Netherlands has some quite tough laws on even possessing virii since the early ninety's.
-- Spelling and grammar errors tend to be a sign of erroneous thinking.