Tue

Aug 14
2007

Brady Forrest

Brady Forrest

Vague Law Scares Off Toolmakers in Germany

ccc_lg.jpg

Over on the Make: blog Bre alerts us that Germany has passed a vague anti-hacking law that outlaws the good with the bad. As he says:

Today in Germany the Hacker Tool Law goes into effect. With the official name of Paragraph 202C, it states that it is illegal to possess, use, produce, or distribute a "hacker tool".

In theory, law enforcement could come and arrest everyone here at Chaos Communications Camp. A group of hackers gathered in solidarity to protest this law. Hackers in Germany have been protesting the making of this law for the past year and are stunned that it passed and has gone into effect.

Over on ZDNet Ryan Naraine writes about the effects already seen in the German tech industry:

Security professionals in Germany have started removing exploits and hacking tools from the Internet in response to a new German law that expressly forbids the distribution of any software that can be used in computer/network attacks.

Stefan Esser (left), the PHP security guru behind the recent Month of PHP Bugs project, has yanked all the proof-of-concept exploits from the project page because of legal concerns related to the new law.

“This new law renders the creation and distribution of software illegal that could be used by someone to break into a computer system or could be used to prepare a break in. This includes port scanners like nmap, security scanners like nessus and of course proof of concept exploits,” Esser explained.

(Photo Credit: Bre)


tags: emerging tech  | comments: 9   | Sphere It
submit:

 
Previous  |  Next

0 TrackBacks

TrackBack URL for this entry: http://blogs.oreilly.com/cgi-bin/mt/mt-t.cgi/5758

Comments: 9

  Markus [08.14.07 03:59 AM]

To be honest, while this law is probably too restrictive I don't really see how publicly available proof-of-concepts help making software more secure - for me those are just a manuals for the hackers.

  dirk husemann [08.14.07 04:22 AM]

@markus: it shows that the exploit is there and real --- often companies just claim that an exploit "is not possible" because they don't it to be true. that however, is a rather toddler-ish attitude ("i don't see you, so you are not there!").

putting on my cynics hat: the german government just doesn't want that kind of expertise (security expertise) in the country and quite likes the brain-drain to continue...

  Ciaran [08.14.07 04:27 AM]

Affects is a verb. You mean effects.

  Ajeet Khurana [08.14.07 04:59 AM]

You know what I think? I think that using the same logic, Germany should ban people possessing or selling "knives." The law makers can probably be forgiven on the basis of good intent. But, their naivette is unforgivable.

And just a few days ago we read about China's invasion on privacy. Is it just me, or are stories related to government's getting into technology getting more common?

  tom wible [08.14.07 10:51 AM]

what the world needs is the extension of the 2nd amendment into the 21st century: the right of the people to keep & bear compilers, dis/assemblers, probes, and all other tools shall not be infringed!

otherwise, we are reduced to the eloi...

  Oliver [08.14.07 11:59 AM]

This story is really unbelievable and nothing to laugh about. There are rumors enough in Germany saying that this is just the beginning of a more complex political story.

People are feeling worried about the fact that big brother might want to install some not so funny tools on German computers. If you make a search for "Bundestrojaner" with Google you`ll find out more about it. Probably you must be able to read German. The Computer Chaos Club might be a good source to be read first. Don`t know if the American press already wrote a view lines about it.

If the story is true this would be a hack made by the Gouvernment themselve to stay informed about everything that happens on German computers. I wonder if we will be allowed to run a firewall later on. Currently "only" testers for software security seem to have a problem because of not beeing allowed to run the tools needed for security checks anymore. No idea how the story goes on but the anti-hacking law does not really look like something that protects us against anything.

  Kevin [08.14.07 10:53 PM]

In the UK (and probably in many countries) there is an offence of 'going equipped for burglary or theft' e.g. you can be stopped in the street if you are carrying a crowbar, a hammer and an empty bag marked 'swag' as it is reasonable to assume you intend to commit an offence.

I can see how some (misguided) lawmakers would think that an equivalent law for online cyber-criminals would be needed whereby just having these tools on your computer is an offence, even if there is no evidence of misuse.

The big difference is in the large number of legitimate uses these 'hacker tools' have and the vague definition of what is a hacker tool.

  Josh Spaulding [08.15.07 02:19 PM]

I don't that's total BS. It's going to compromise security and the hackers will always find ways around it!

My Wife is German and our son is 1/2. I love Germany and I actually agree with their government more than our own in many cases but not this time.

  Andy Wong [08.15.07 03:54 PM]

Eventually hackers and security professionals have to go underground making law enforcement virtually nothing. This kind of law is simply political corrective law, but stupid enough do more bad than good in result. While hackers are generally happily living underground, the skills of security professionals will be well limited and hardly updated. As a result, the battle between hackers and security professionals will be unbalanced.

Post A Comment:

 (please be patient, comments may take awhile to post)






Type the characters you see in the picture above.

RECENT COMMENTS