Strict German Computer Crime Law Now in Effect 226
SkiifGeek writes "With little fanfare, section 202c of the German computer crime laws came into effect over the weekend. Worryingly for Security professionals, the laws make the mere possession of (creates, obtains or provides access to, sells, yields, distributes or otherwise allows access to) many useful tools illegal. A similar law was proposed for the UK, however it was modified prior to passing through parliament due to the outcry from the industry. Phenoelit, KisMAC, the CCC, and the Month of PHP Bugs are just some of the relatively high profile projects and groups to have already taken measures to remove or modify content under this law."
Very smart move (Score:5, Funny)
Re: (Score:2, Insightful)
Re:Very smart move (Score:4, Informative)
I'm not sure it was invoked here.
Re:Very smart move (Score:5, Funny)
There you go.
Re: (Score:3, Informative)
Re: (Score:2)
You haven't read the first post, have you?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
These cracking tools are great ways to check for security issues with a network. I use nmap all the time for general networking to find out what service are running on a server that I can use.
Damn it Charles!
So... (Score:4, Insightful)
Looks like I'm a criminal in Germany then. Wonder when they're gonna demand my extradition...
Oh wow... (Score:4, Funny)
They won't even notice the URL. It'll be encrypted under SSL.
Re:Oh wow... (Score:5, Informative)
Re: (Score:2)
Outside of someone telling on you, I would imagine you telling on yourself or someone complaining that your IP did X which seems like hacker tools were used and they come checking.
Damn that bush, oh wait, this is Germany, damn that busch. (is but supreme leader of germany too?)
Re:Oh wow... (Score:5, Insightful)
Reasonable use (Score:3, Insightful)
Likely, people with a good reason to posess hacker tools (eg. legitimate anti-virus folk) will be allowed controlled tools - much like how the people who design kevlar vests are allowed to have automatic weapons etc for legitimate test purposes.
Re: (Score:3, Insightful)
I'd add most or all system and network administrators. Suddenly, the group isn't very limited any longer. Anyone can be a system administrator if he owns at least one computer.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
And where is that free state you are talking about? Certainly not between Canada and Mexico...
Re: (Score:2)
And where is that free state you are talking about?
Washington, Idaho, Montana, Nevada, ...
Re: (Score:2)
Re: (Score:2)
You're suggesting thatthe law wont be abused, but if those
Re: (Score:2)
Re: (Score:2)
I posted an automated translation of the law in response to Fyodor's thread, above. But the relevant fact is that the "purpose" of the tool must be hacking. So, you'd be pretty safe with these. Fyodor's on a little muddier ground, though.
Re: (Score:2)
Fine, then bury the old unix mentality "one tool for one problem", add a picture viewer to your botnet-installer-rootkit-worm. Or an IM client to your DRM breaker, if you are more concerned with the original than with this new german DMCA++ clone. It's never as easy as you would like it to be.
Makes perfect sense... NOT (Score:2)
Makes you wonder if any of the vulnerability scanner companies will ever be able to do business in Germany again. I guess every company that has such a scanner has to now turn the devices over to the state?
The good news for hackers. . . . (Score:3, Interesting)
Re: (Score:2)
When you think of the German Federal Trojan project [theregister.co.uk], I mean, how else would you want to use it against people who actually know what they're doing?
Re: (Score:2)
There is no effective law against curiousity (Score:5, Insightful)
Now a Damocles sword hangs over the head of the genuinely interested German hacker. And hacks will continue across the rest of the planet, because improvements are iterative lessons learned from mistakes.
Why not instead develop infrastructure that allows ISPs to eliminate machines controlled by bots? Or find a way to make a better international citizen out of PTT-behaving Deutche Telekom/T-Mobile? Or perhaps learn the lessons from the fear-engendering legislation that's now law.....
Re:There is no effective law against curiousity (Score:5, Funny)
Re:There is no effective law against curiousity (Score:5, Insightful)
Re: (Score:3, Funny)
Schrodinger's Cat (Score:5, Funny)
But in this case you won't know for sure if the cat is dead until the German police kick in your door to look.
Re: (Score:2)
Re:There is no effective law against curiousity (Score:5, Insightful)
I believe it was Thomas Paine circa AD 1776 or so, who wrote: "In order that liberty be preserved, we must not allow oppression even unto our enemies, for in doing so we set a precedent that reaches back into ourselves."
What goes around, comes around. Perhaps the more this crap hits the geek community, the more you realize that "free speech" refers to "all speech" not just yours. The same with "free" anything. And the same whether it starts in Europe or here. The Socialists left Germany and Russia and eventually conquered America without firing a single shot. Thank John Dewey and the Prussian Socialist School System he pioneered for us "'murkens".
PS - there is NO "well intentioned" law that ever restricts any freedom, except that to take action and to garner the natural consequences of one's action. State enforced "consequences" (aka punishments) and "criminal" status that occurs via the stroke of a pen is never well intentioned. Only seems so to those who still believe in "random coincidences in politics".
Re: (Score:3, Insightful)
Obviously, this one was both ill-conceived and ill-executed.
It stops nothing but improvement.
Perhaps we can hire some ex-pat German coders! H1Bs ought to be easy now, right??
Re:There is no effective law against curiousity (Score:5, Funny)
That's right, I countered your Thomas Paine quote with another Thomas Paine quote. I'm challenging you to a Thomas Paine quote-off! May the best Thomas Paine quoter win! I urgently await your reply.
Re: (Score:2, Interesting)
Well, I guess we're really screwed then. To quote Thomas Paine, "The greatest remedy for anger is delay."
By the time everyone else gets outraged about this, we'll all be cooled off.
Re: (Score:2)
Re: (Score:3, Insightful)
Not really. At least not the way you like to understand it.
On a related side note -- not mentioned in the summary -- German legislation is currently pursuing efforts to get police and intelligence a new tool called "online searching", meaning just like they already can tap your phone or browse your bank account without you (or your phone company or bank) not even noticing they want to invade and raid your PC, scanning your HD and browsing your files.
Since this requires techniques co
Re: (Score:2)
Not that Germany is doing any worse in that regard than the U.S. or England. None of them seem to have a clue when it comes to networks and the Internet, and genuinely seem to wish it would all just go away.
Insensitive, but... (Score:5, Funny)
Then they came for the portscanners, but I said nothing, because I was not trying to hack boxes
Then they came for the packet sniffers, but I said nothing because I thought my firewall was strong enough
Then they came for SATAN, and I didn't speak up because I wasn't an admin
And then, they came for my elite box, and I had to go back to using my mom's e-Machine, and I cried and cried
Re: (Score:2)
Time to SIGALRM before it's too late (Score:5, Funny)
Then they came for process_id 0050, but I did not SIGTRP because I did not depend on that process.
Then they came for process_id 0003, but I did not SIGALRM because my timer had not yet expired.
When they came for me, there were no processes left from which to spawn.
So, has anyone read the law? (Score:2, Insightful)
So, is there anyone reading this who 1) understands German and 2) has read the law?
Does it happen to say anything about "intent"? Cause most every law I've read in English that was reported similarly to this law has, and the reporting is just a blatant attempt to stir up hysteria.
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
A lot of representative of the Bundestag have discussed that meaning of that article.
(http://www.abgeordnetenwatch.de/index.php?cmd=223 &id=0&q=%22%A7+202+StGB%22)
They all state that the PRIMARY INTENTION of the programmer / distributor / user has to be to hack someone.
( Danach sind nur Computerprogramme betroffen, die in erster Linie dafür ausgelegt oder hergestellt werden, um damit Straftaten nach 202a, 202b StGB zu begehen. )
A few have also said, that they possib
As the author of Nmap ... (Score:5, Interesting)
Does anyone have a link to a good English translation and legal analysis of the new law? The Phenoelit page [phenoelit.de] translates the law as affecting "computer programs whose aim is to commit a crime". That doesn't cover Nmap, which I designed for security professionals. But of course some blackhats use it too, and I don't want to bet my freedom on being able to convince a technologically illiterate judge in Germany of my intent.
I hope groups like the CCC [ccc.de] (which is apparently quite powerful in Germany) are able to get this overturned! If legitimate German admins are afraid to use Nmap and other security tools while the crackers retain full access to them, that won't be a pretty sight!
-Fyodor
Insecure.Org [insecure.org]
More Generally, Fyodor (Score:2)
Re:More Generally, Fyodor (Score:5, Insightful)
I'm not going to use guns as a metaphor because of the whole "gun control" debate, and also because guns have the valid use of self-defense... So let's use something more aggressive, say, hand grenades.
There is no valid reason for a non-military person to be able to own a hand grenade. The grenade cannot be used for any peaceful purpose, nor for self defense, because of it's extremely high collateral damage. Even if there is a _potential_ valid use (I dunno, maybe throw it down a mole hole in your backyard to kill the pesky mole, LOL), the destructive potential vastly outweights any valid use, and therefore I accept as valid the restriction of owning a hand grenade by the average person.
The other option is to own, say, a knife or pickaxe. Yes, some people can (and do) use those as weapons for illegal purposes, but this does not stop the tool from having a valid, legal use (in fact, it's primary design is indeed a legal one). Therefore, outlawing pickaxes because some idiot happened to kill someone else with one, is not a valid move.
The German law is a prime example of the second option. As I explained in my other comment on this thread, the damage done to valid users is much bigger than any possible achieved restriction on criminals.
Re: (Score:3, Insightful)
Re: (Score:2)
If you are trained, you can kill people with your hands, elbows and feet. Just make these also illegal.
Re: (Score:2)
Of course it can be used for self-defense. In fact, if guns are common enough that thugs will shoot you in the back before looting you, the defense against that would be to carry a hand grenade with you, connected to a dead mans trigger. If your heart stops, the grenade explodes, possibly killing t
Re: (Score:2)
As a person who has used Nmap for many legitimate, totally legal debugging I'd like to say thanks for a really handy tool. When using Nmap I always think something like: 'this would be illegal in Germany, how f*cking stupid.'
Being unable to use Nmap (and tools like it) means application developers and network administrators are unable to do their jobs without breaking the law. Admins should refuse to look into networking problems and software engineers should refuse to fix bugs, wor
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:2)
Re:As the author of Nmap ... (Score:4, Interesting)
I find the idea that this is any worse than the UK law that passed strange:
Section (2) is much more general than the German law, requiring only that you believe it likely that the article supplied will be used in such a crime, while the German law requires intent that it be used in such a crime. Plus, the UK law allows 2 years imprisonment, the German law only one.
So, all in all, I'd say you're on much safer grounds visiting Germany than the UK over this one.
Re: (Score:2)
Re: (Score:2)
n 2002, Fyodor was the victim of an impersonation attack by a Slashdot user who was posing as a woman. Fyodor sent an email to the fake "woman" in an attempt to solicit further conversation and a possible meeting. When the hoax was revealed, the hoaxer insulted fyodor (I believe the word was "wanker").
Fyodor responded by using information disclosure vuln
Re: (Score:2)
You're using one example to justify a ridiculous generalization about the use of Nmap. Just because your example included the author of the tool (if this story is even true or not) is irrelevant.
I think you missed the point of the argument entirely. Nmap has real, legitimate use. In fact, I use it on a regular basis to scan my local area network to make sure no suspicious ports are open that may be trojan infections. So when does trying to keep my network clean of viruses an
Law not just evil but also dumb (Score:5, Insightful)
OK, so we ignore the potential for abuse. But that still leaves the question: how, exactly, is the law supposed to protect anyone?
- The possession of this software is virtually undetectable unless some kind of crime has been committed using them (such as using it to actually attack someone else's machine). Well guess what, attacking someone else's machine has ALREADY been illegal (and justly so).
- People who were and are willing and able to use these tools to attack other machines have already risked punishment far greater than the punishment meted out for merely possessing the equipment.
- Think about this analogy: If you outlaw the possession of crowbars (because they are used by burglars), who will suffer more, the burglar or the construction worker who also happens to need a crowbar? Of course the construction worker -- the burglar operates in secret and the worker in open; and if caught, the punishment for burglary is significantly bigger to the point that someone willing to perform a burglary will not care for the (relatively small) additional punishment given for the possession of the crowbar. But for the construction worker, this law means losing his job.
- Some people would see an analogy between this law and advocation of gun control (less guns = supposedly less violence). But unlike gun control, where restricting guns (at least theoretically) makes it harder for criminals to obtain them, this law cannot possibly do anything to prevent the obtainment of these "hacking" tools, which can only be detected ex post facto.
So, if this law...
- Does nothing to reduce the availability of these tools
- Does nothing to reduce the potential destructive purpose of these tools
- Does not provide a serious deterrent to would-be abusers of these tools
- DOES, however, significantly limit the LAWFUL use of these tools by security professionals
Then why the heck is it needed? Heck, if I was a blackhat, I'd be very, very happy that security auditors got the shaft, meaning I have a much better chance of finding exploits which the good guys didn't get a legal chance to find and close first.
It seems that the quote "those who sacrifice liberty for security deserve nothing and lose both" never held truer, because not only liberty is sacrificed, but from any possible perspective hacking has became EASIER as a result of this law, not harder.
Re: (Score:2)
Then why the heck is it needed?
Because the law was passed by idiots who don't understand the technology?
The disturbing thing is that quite probably stupid laws are being passed all the time in other areas where we aren't experts - farming, food, pharma, etc. And to think that my [UK] government is made up almost entirely of professional politicians who don't have any scientific education at all beyond the bare minimum that finishes at age 16. (And they're probably proud of this). Is this any way to
Re: (Score:2, Interesting)
The possession of this software is virtually undetectable unless some kind of crime has been committed using them (such as using it to actually attack someone else's machine). Well guess what, attacking someone else's machine has ALREADY been illegal (and justly so).
I would say "you are right" by just looking at this law. Being a German citizen I can also see other attempts of the government that go into the direction of seeiking private PCs online and without letting the user know. Of course they say it
Re: (Score:2)
You're an optimist
As always, people will happily vote for the party whose Incredible Taxation Change Miracle promises to create the biggest net win for everybody, out of some deliberate calculation error deeply hidden within the dungeons of an overclomplex taxation system (parts of the insurance system included).
Re: (Score:2)
But unlike gun control, where restricting guns (at least theoretically) makes it harder for criminals to obtain them, [...]
One minor point here. The real reason for having gun control is to restrict the access of crazies to things with which they can cause large scale damage with. In the UK at least, it was recognized when the start of the current control regime was brought in that it was unlikely to have much effect on criminal access to guns, but it has had the effect of preventing a repeat of the Dunblane massacre [wikipedia.org].
Defcon must be good for something (Score:2, Funny)
Re: (Score:2)
Defense by incompetance (Score:3, Insightful)
Every Browser is now Illegal (Score:2, Interesting)
It's 9am in Germany... (Score:3, Funny)
And I've just run an nmap scan of bundestag.de [bundestag.de] .
I await the knock on my door with interest.
THC already hit (Score:4, Informative)
The THC (The Hackers Choice) group has already been forced to discontinue some of it's best projects due to this absurd law.
http://www.thc.org/ [thc.org]Silenced are THC's Credit, Hydra, Scan and War-Drive. Hydra will be the most missed, as it was one of the best authentication bruteforcers. Not dwelling on this defeat to freedom of information and the security community, I suggest everyone in the security community begin resisting this trend towards silencing the messenger of insecurities.
We should be working to create new tools and better means by which to distribute information and code, both securely and anonymously. The foolish politicians and companies who think they can dare enforce security by ignoring the problem and silencing individuals should be shown that this strategy does not work. This is yet another challenge to all the security researchers and programmers, will you allow others to dictate your creativity?
Ebayers, beware. (Score:2)
Don't laugh. The same thing happened when they outlawed CD/DVD copying software. Sell a stack of old magazines, get slapped with a hefty lawsuit and probably put on trial.
unintended consequences (Score:2, Insightful)
Oops.
Re: (Score:2)
Is it against "hackers"? Or against self defense (Score:2, Insightful)
Wolfgang Schäuble (German's clinically paranoid home secretary) has been pushing hard to get the "Bundestrojaner" (federal trojan) approved and legal. Now, what is the worth of a trojan that can be detected?
I mean, it could be a coincidence that those things appear at the same time. I just don't believe in coincidence. Especially when you're dealing with unenforcable laws, since this one is not enforceable. Unless, of course, you have a good reason to believ
Re:Is it against "hackers"? Or against self defens (Score:2)
Honi soit qui mal y pense.
Not so (Score:2)
Where does it say 'possess'? As far as I can see, all it says is that if you break in or make it possible for others to break in, then you are violating the law. Your interpretation goes far beyond that, and I think it is likely because you want to see it as a violation of some sort of 'freedom'. If one were to use the same sort of interpretation on, say, breaking into a ho
They don't care. (Score:2)
Bad move (Score:2)
BillSF
Re: (Score:2)
What an absurd idea. That wouldn't get anyone elected. Besides, law enforcment is expensive and would be a drain on the governments finances. Making a couple of laws is so much cheaper and demonstrates activity to the voters.
Same FUD, different day... (Score:5, Funny)
It is an unusual characteristic of Germany that everyone suffers from angst (fair enough, they invented the word) but the angst is all about really unlikely events (acrylimide in barbeque food causing cancer for example) and yet they throw caution to the winds the moment they get in a car.
This angst condition is so endemic I have christened it "Fright Club". Only a few weeks ago they were obsessed with "wifi smog" people were switching of their routers and phones to protect themselves from this new scourge. It didn't appear to stop them from watching television or listening to the radio, but there you go - science and magic confused or just interchangeable.
Coupled with this angst is another curious condition called Gründlichkeit or thoroughness. Gründlichkeit is just so much part of the German character. Back in Scotland you could read the important parts of the Blue Book tax guide in the bookshop and easily identify any new legal tax avoidance strategies. You couldn't do that with the German Tax Books because there are about 127 of them (the last time I tried to count them). My accountant just photocopies pages out and sticks them in the tax return. You have to pay canal tax but there's no canal and you don't get one either.
In Germany when you change your address, you have to inform the special municipal department -Wohnanmeldegungamt- (department of names and addresses)of the change and fill in three forms. A group of students could not understand how this did not exist in Britain or USA. "What's to stop you getting on a plane, flying to the UK, robbing a bank and then flying home?" was their completely serious question and my answer: "Even German bank robbers don't normally use their identity cards or leave a forwarding address during the robbery," leaves them completely unconvinced.
Conversation with Wohnamt Official:
Official:"What is your father's occupation?"
"He's dead, what difference does it make?"
Official:"I have a space in the form for it"
"which job would you like?"
Official:"His last one..."
Official:"What religion are you?"
(proudly) "Agnostic"
Official:"You can have: Catholic, Protestant or atheist."
"But I'm an agnostic"
Official: Ticks 'atheist'
As for thoroughness, Non-German partners are often very surprised when they clean the entire house from top to bottom only to have their partner point out that they forgot the single cup they drank their post cleaning coffee in which is standing on the immaculate sink - dirty. There is no mention of all the good work, because the concept of balancing good things against negative things (one good thing outweighs loads of bad things) is rather specific to English speakers. German anthropology uses the concept of a linear measure of perfection (or distance from it!) and the streets are so clean you could eat your dinner off them. Well, almost but this is the real reason behind this action, more national character than conspiracy.
Re: (Score:3, Informative)
In Germany when you change your address, you have to inform the special municipal department -Wohnanmeldegungamt- (department of names and addresses)of the change
Well, it's Einwohnermeldeamt (resident registration office), and the fun part is that it's even worse. The complete process includes:
1) Going to the Einwohnermeldeamt of the place you've been living before, spend several hours in waiting rooms full of seriously pissed off people and get a written "deregistration" confirmation.
2) Going to the Einwohnermeldeamt of the new place, spend several hours in waiting rooms full of seriously pissed off people, show said confirmation, and also give them the copy of th
All this really says is ....... (Score:2)
Its an industry problem the legal system is failing to properly motivate correct where it is actually needed.
Treating the symptom is not going to cure the disease. But it will lead to other symptoms that will further be treated.
Re:Germany... (Score:4, Insightful)
Back to the topic, though; the internet should simply be declared a public place and laws pertaining to such public places shttp://www.dslreports.com/hould be applied, rather than creating a whole new set of laws for the internet. There are enough laws already; furthermore, laws everywhere are different; it just causes undue conflict.
Of course, sites which require the user to click a link indicating that they agree to a set of terms (door) or to login (lock) should be treated as private property and those laws should apply.
Here's the fun part: get every country with internet access to go along with this.
Hell, I'd be happy if they just did it in the US.
Re:Germany... (Score:4, Insightful)
No, you're eternally off-topic for responding to a troll post just to get a higher placement.
Re: (Score:2, Insightful)
Further, you're not an IRC user, are you? Script-kiddies (with the sam
Re: (Score:3, Funny)
Re:source code t-shirts again? (Score:5, Funny)
Don't you mean 'double sided double density hacker tool'?
(thanxx to Jerry Pournelle for that one...)
Re: (Score:2)
Except that possession of 'criminal tools' such as lock picks, bump keys, etc if one is not a licensed locksmith is a criminal offense. What can be described as a 'criminal tool'? Why,
Re: (Score:3, Informative)
A criminal tool is something that a DA can stand in front of twelve randomly chosen citizens with no particular knowledge, and convince them that, not only that it can be used as a criminal tool, but that the defendant should have known that and did it anyway.
Re: (Score:2)
Unless he's accused of terrorism. Then the pen was clearly meant to be used as a murder weapon by pushing it into someone's brains through their ears; and since it can then be retrieved and used again, it is clearly a mass murder weapon. Assuming h
Re: (Score:2)
When the majority of people think that "hackers" are using "computer codes" t
Re: (Score:2, Informative)
That depends on where you are. I live in Canada. In a former life I was a Sheriff. And I had a nice set of lock picks, a very slick pick gun, and a couple of slide hammers. Most of which were stamped "law enforcement use only". I was never a locksmith, though....
Re: (Score:2)
Re: (Score:2)