Slashdot Log In
Strict German Computer Crime Law Now in Effect
Posted by
Zonk
on Sun Aug 12, 2007 11:18 PM
from the going-to-jail-for-doing-your-job dept.
from the going-to-jail-for-doing-your-job dept.
SkiifGeek writes "With little fanfare, section 202c of the German computer crime laws came into effect over the weekend. Worryingly for Security professionals, the laws make the mere possession of (creates, obtains or provides access to, sells, yields, distributes or otherwise allows access to) many useful tools illegal. A similar law was proposed for the UK, however it was modified prior to passing through parliament due to the outcry from the industry. Phenoelit, KisMAC, the CCC, and the Month of PHP Bugs are just some of the relatively high profile projects and groups to have already taken measures to remove or modify content under this law."
Related Stories
[+]
Politics: Germany Declares Hacking Tools Illegal 299 comments
dubbelj writes "Germany has updated their computer crime law to declare 'hacking tools' illegal. This will place most of the professionals in the network admin and computer security fields in a sort of legal grey area. 'The new rules tighten up the existing sanctions and prohibit any unauthorized user from disabling or circumventing computer security measures to access secure data (see the law, sections 200 and following [in German]). Manufacturing, programming, installing, or spreading software that can circumvent security measures is verboten, which means that some security scanning tools might become illegal.' We discussed a similar measure in January when Australia considered the same kind of legislation. How will this affect Linux distribution in Germany, as most standard Linux distributions come with these kind of 'hacking tools' installed by default?"
[+]
Your Rights Online: UK Moves to Outlaw 'Hacker Tools' 308 comments
twitter writes "New guidance rules for the UK's controversial Computer Misuse Act do not allay fears of impracticality, or of the banning of legitimate IT software: 'The government has come through with guidelines that address some, but not all, of these concerns about dual-use tools. The guidelines establish that to successfully prosecute the author of a tool it needs to be shown that they intended it to be used to commit computer crime. But the Home Office, despite lobbying, refused to withdraw the distribution offense. This leaves the door open to prosecute people who distribute a tool, such as nmap, that's subsequently abused by hackers.'" Somewhat similar legislation recently became law in Germany.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Very smart move (Score:5, Funny)
Re: (Score:2, Insightful)
Re:Very smart move (Score:4, Informative)
I'm not sure it was invoked here.
Parent
Re:Very smart move (Score:5, Funny)
There you go.
Parent
Re: (Score:3, Informative)
Re: (Score:2)
So... (Score:4, Insightful)
Looks like I'm a criminal in Germany then. Wonder when they're gonna demand my extradition...
Oh wow... (Score:4, Funny)
They won't even notice the URL. It'll be encrypted under SSL.
Parent
Re:Oh wow... (Score:5, Informative)
Parent
Re:Oh wow... (Score:5, Insightful)
Parent
Reasonable use (Score:3, Insightful)
Likely, people with a good reason to posess hacker tools (eg. legitimate anti-virus folk) will be allowed controlled tools - much like how the people who design kevlar vests are allowed to have automatic weapons etc for legitimate test purposes.
Re: (Score:3, Insightful)
I'd add most or all system and network administrators. Suddenly, the group isn't very limited any longer. Anyone can be a system administrator if he owns at least one computer.
Makes perfect sense... NOT (Score:2)
Makes you wonder if any of the vulnerability scanner companies will ever be able to do business in Germany again. I guess every company that has such a scanner has to now turn the devices over to the state?
The good news for hackers. . . . (Score:3, Interesting)
There is no effective law against curiousity (Score:5, Insightful)
Now a Damocles sword hangs over the head of the genuinely interested German hacker. And hacks will continue across the rest of the planet, because improvements are iterative lessons learned from mistakes.
Why not instead develop infrastructure that allows ISPs to eliminate machines controlled by bots? Or find a way to make a better international citizen out of PTT-behaving Deutche Telekom/T-Mobile? Or perhaps learn the lessons from the fear-engendering legislation that's now law.....
Re:There is no effective law against curiousity (Score:5, Funny)
Parent
Re:There is no effective law against curiousity (Score:5, Insightful)
Parent
Re: (Score:3, Funny)
Schrodinger's Cat (Score:5, Funny)
But in this case you won't know for sure if the cat is dead until the German police kick in your door to look.
Parent
Re:There is no effective law against curiousity (Score:5, Insightful)
I believe it was Thomas Paine circa AD 1776 or so, who wrote: "In order that liberty be preserved, we must not allow oppression even unto our enemies, for in doing so we set a precedent that reaches back into ourselves."
What goes around, comes around. Perhaps the more this crap hits the geek community, the more you realize that "free speech" refers to "all speech" not just yours. The same with "free" anything. And the same whether it starts in Europe or here. The Socialists left Germany and Russia and eventually conquered America without firing a single shot. Thank John Dewey and the Prussian Socialist School System he pioneered for us "'murkens".
PS - there is NO "well intentioned" law that ever restricts any freedom, except that to take action and to garner the natural consequences of one's action. State enforced "consequences" (aka punishments) and "criminal" status that occurs via the stroke of a pen is never well intentioned. Only seems so to those who still believe in "random coincidences in politics".
Parent
Re: (Score:3, Insightful)
Obviously, this one was both ill-conceived and ill-executed.
It stops nothing but improvement.
Perhaps we can hire some ex-pat German coders! H1Bs ought to be easy now, right??
Re:There is no effective law against curiousity (Score:5, Funny)
That's right, I countered your Thomas Paine quote with another Thomas Paine quote. I'm challenging you to a Thomas Paine quote-off! May the best Thomas Paine quoter win! I urgently await your reply.
Parent
Re: (Score:2, Interesting)
Well, I guess we're really screwed then. To quote Thomas Paine, "The greatest remedy for anger is delay."
By the time everyone else gets outraged about this, we'll all be cooled off.
Re: (Score:3, Insightful)
Not really. At least not the way you like to understand it.
On a related side note -- not mentioned in the summary -- German legislation is currently pursuing efforts to get police and intelligence a new tool called "online searching", meaning just like they already can tap your phone or browse your bank account without you (or your phone company or bank) not even noticing they want to invade and raid your PC, scanning your HD and browsing your files.
Since this requires techniques co
Insensitive, but... (Score:5, Funny)
Then they came for the portscanners, but I said nothing, because I was not trying to hack boxes
Then they came for the packet sniffers, but I said nothing because I thought my firewall was strong enough
Then they came for SATAN, and I didn't speak up because I wasn't an admin
And then, they came for my elite box, and I had to go back to using my mom's e-Machine, and I cried and cried
Time to SIGALRM before it's too late (Score:5, Funny)
Then they came for process_id 0050, but I did not SIGTRP because I did not depend on that process.
Then they came for process_id 0003, but I did not SIGALRM because my timer had not yet expired.
When they came for me, there were no processes left from which to spawn.
So, has anyone read the law? (Score:2, Insightful)
So, is there anyone reading this who 1) understands German and 2) has read the law?
Does it happen to say anything about "intent"? Cause most every law I've read in English that was reported similarly to this law has, and the reporting is just a blatant attempt to stir up hysteria.
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
A lot of representative of the Bundestag have discussed that meaning of that article.
(http://www.abgeordnetenwatch.de/index.php?cmd=223 &id=0&q=%22%A7+202+StGB%22)
They all state that the PRIMARY INTENTION of the programmer / distributor / user has to be to hack someone.
( Danach sind nur Computerprogramme betroffen, die in erster Linie dafür ausgelegt oder hergestellt werden, um damit Straftaten nach 202a, 202b StGB zu begehen. )
A few have also said, that they possib
As the author of Nmap ... (Score:5, Interesting)
Does anyone have a link to a good English translation and legal analysis of the new law? The Phenoelit page [phenoelit.de] translates the law as affecting "computer programs whose aim is to commit a crime". That doesn't cover Nmap, which I designed for security professionals. But of course some blackhats use it too, and I don't want to bet my freedom on being able to convince a technologically illiterate judge in Germany of my intent.
I hope groups like the CCC [ccc.de] (which is apparently quite powerful in Germany) are able to get this overturned! If legitimate German admins are afraid to use Nmap and other security tools while the crackers retain full access to them, that won't be a pretty sight!
-Fyodor
Insecure.Org [insecure.org]
More Generally, Fyodor (Score:2)
Re:More Generally, Fyodor (Score:5, Insightful)
I'm not going to use guns as a metaphor because of the whole "gun control" debate, and also because guns have the valid use of self-defense... So let's use something more aggressive, say, hand grenades.
There is no valid reason for a non-military person to be able to own a hand grenade. The grenade cannot be used for any peaceful purpose, nor for self defense, because of it's extremely high collateral damage. Even if there is a _potential_ valid use (I dunno, maybe throw it down a mole hole in your backyard to kill the pesky mole, LOL), the destructive potential vastly outweights any valid use, and therefore I accept as valid the restriction of owning a hand grenade by the average person.
The other option is to own, say, a knife or pickaxe. Yes, some people can (and do) use those as weapons for illegal purposes, but this does not stop the tool from having a valid, legal use (in fact, it's primary design is indeed a legal one). Therefore, outlawing pickaxes because some idiot happened to kill someone else with one, is not a valid move.
The German law is a prime example of the second option. As I explained in my other comment on this thread, the damage done to valid users is much bigger than any possible achieved restriction on criminals.
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Re:As the author of Nmap ... (Score:4, Interesting)
I find the idea that this is any worse than the UK law that passed strange:
Section (2) is much more general than the German law, requiring only that you believe it likely that the article supplied will be used in such a crime, while the German law requires intent that it be used in such a crime. Plus, the UK law allows 2 years imprisonment, the German law only one.
So, all in all, I'd say you're on much safer grounds visiting Germany than the UK over this one.
Parent
Law not just evil but also dumb (Score:5, Insightful)
OK, so we ignore the potential for abuse. But that still leaves the question: how, exactly, is the law supposed to protect anyone?
- The possession of this software is virtually undetectable unless some kind of crime has been committed using them (such as using it to actually attack someone else's machine). Well guess what, attacking someone else's machine has ALREADY been illegal (and justly so).
- People who were and are willing and able to use these tools to attack other machines have already risked punishment far greater than the punishment meted out for merely possessing the equipment.
- Think about this analogy: If you outlaw the possession of crowbars (because they are used by burglars), who will suffer more, the burglar or the construction worker who also happens to need a crowbar? Of course the construction worker -- the burglar operates in secret and the worker in open; and if caught, the punishment for burglary is significantly bigger to the point that someone willing to perform a burglary will not care for the (relatively small) additional punishment given for the possession of the crowbar. But for the construction worker, this law means losing his job.
- Some people would see an analogy between this law and advocation of gun control (less guns = supposedly less violence). But unlike gun control, where restricting guns (at least theoretically) makes it harder for criminals to obtain them, this law cannot possibly do anything to prevent the obtainment of these "hacking" tools, which can only be detected ex post facto.
So, if this law...
- Does nothing to reduce the availability of these tools
- Does nothing to reduce the potential destructive purpose of these tools
- Does not provide a serious deterrent to would-be abusers of these tools
- DOES, however, significantly limit the LAWFUL use of these tools by security professionals
Then why the heck is it needed? Heck, if I was a blackhat, I'd be very, very happy that security auditors got the shaft, meaning I have a much better chance of finding exploits which the good guys didn't get a legal chance to find and close first.
It seems that the quote "those who sacrifice liberty for security deserve nothing and lose both" never held truer, because not only liberty is sacrificed, but from any possible perspective hacking has became EASIER as a result of this law, not harder.
Defcon must be good for something (Score:2, Funny)
Defense by incompetance (Score:3, Insightful)
It's 9am in Germany... (Score:3, Funny)
And I've just run an nmap scan of bundestag.de [bundestag.de] .
I await the knock on my door with interest.
THC already hit (Score:4, Informative)
The THC (The Hackers Choice) group has already been forced to discontinue some of it's best projects due to this absurd law.
http://www.thc.org/ [thc.org]Silenced are THC's Credit, Hydra, Scan and War-Drive. Hydra will be the most missed, as it was one of the best authentication bruteforcers. Not dwelling on this defeat to freedom of information and the security community, I suggest everyone in the security community begin resisting this trend towards silencing the messenger of insecurities.
We should be working to create new tools and better means by which to distribute information and code, both securely and anonymously. The foolish politicians and companies who think they can dare enforce security by ignoring the problem and silencing individuals should be shown that this strategy does not work. This is yet another challenge to all the security researchers and programmers, will you allow others to dictate your creativity?
Same FUD, different day... (Score:5, Funny)
It is an unusual characteristic of Germany that everyone suffers from angst (fair enough, they invented the word) but the angst is all about really unlikely events (acrylimide in barbeque food causing cancer for example) and yet they throw caution to the winds the moment they get in a car.
This angst condition is so endemic I have christened it "Fright Club". Only a few weeks ago they were obsessed with "wifi smog" people were switching of their routers and phones to protect themselves from this new scourge. It didn't appear to stop them from watching television or listening to the radio, but there you go - science and magic confused or just interchangeable.
Coupled with this angst is another curious condition called Gründlichkeit or thoroughness. Gründlichkeit is just so much part of the German character. Back in Scotland you could read the important parts of the Blue Book tax guide in the bookshop and easily identify any new legal tax avoidance strategies. You couldn't do that with the German Tax Books because there are about 127 of them (the last time I tried to count them). My accountant just photocopies pages out and sticks them in the tax return. You have to pay canal tax but there's no canal and you don't get one either.
In Germany when you change your address, you have to inform the special municipal department -Wohnanmeldegungamt- (department of names and addresses)of the change and fill in three forms. A group of students could not understand how this did not exist in Britain or USA. "What's to stop you getting on a plane, flying to the UK, robbing a bank and then flying home?" was their completely serious question and my answer: "Even German bank robbers don't normally use their identity cards or leave a forwarding address during the robbery," leaves them completely unconvinced.
Conversation with Wohnamt Official:
Official:"What is your father's occupation?"
"He's dead, what difference does it make?"
Official:"I have a space in the form for it"
"which job would you like?"
Official:"His last one..."
Official:"What religion are you?"
(proudly) "Agnostic"
Official:"You can have: Catholic, Protestant or atheist."
"But I'm an agnostic"
Official: Ticks 'atheist'
As for thoroughness, Non-German partners are often very surprised when they clean the entire house from top to bottom only to have their partner point out that they forgot the single cup they drank their post cleaning coffee in which is standing on the immaculate sink - dirty. There is no mention of all the good work, because the concept of balancing good things against negative things (one good thing outweighs loads of bad things) is rather specific to English speakers. German anthropology uses the concept of a linear measure of perfection (or distance from it!) and the streets are so clean you could eat your dinner off them. Well, almost but this is the real reason behind this action, more national character than conspiracy.
Re: (Score:3, Informative)
In Germany when you change your address, you have to inform the special municipal department -Wohnanmeldegungamt- (department of names and addresses)of the change
Well, it's Einwohnermeldeamt (resident registration office), and the fun part is that it's even worse. The complete process includes:
1) Going to the Einwohnermeldeamt of the place you've been living before, spend several hours in waiting rooms full of seriously pissed off people and get a written "deregistration" confirmation.
2) Going to the Einwohnermeldeamt of the new place, spend several hours in waiting rooms full of seriously pissed off people, show said confirmation, and also give them the copy of th
Re:Germany... (Score:4, Insightful)
Back to the topic, though; the internet should simply be declared a public place and laws pertaining to such public places shttp://www.dslreports.com/hould be applied, rather than creating a whole new set of laws for the internet. There are enough laws already; furthermore, laws everywhere are different; it just causes undue conflict.
Of course, sites which require the user to click a link indicating that they agree to a set of terms (door) or to login (lock) should be treated as private property and those laws should apply.
Here's the fun part: get every country with internet access to go along with this.
Hell, I'd be happy if they just did it in the US.
Parent
Re:Germany... (Score:4, Insightful)
No, you're eternally off-topic for responding to a troll post just to get a higher placement.
Parent
Re: (Score:3, Funny)
Re:source code t-shirts again? (Score:5, Funny)
Don't you mean 'double sided double density hacker tool'?
(thanxx to Jerry Pournelle for that one...)
Parent
Re: (Score:2)
Except that possession of 'criminal tools' such as lock picks, bump keys, etc if one is not a licensed locksmith is a criminal offense. What can be described as a 'criminal tool'? Why,
Re: (Score:3, Informative)
A criminal tool is something that a DA can stand in front of twelve randomly chosen citizens with no particular knowledge, and convince them that, not only that it can be used as a criminal tool, but that the defendant should have known that and did it anyway.