Illegalization of admin tools

[Ralph Grothe]

Hi,

although this is foremost a forum for the exchange of technical topics and not to be hijacked for venting susceptably politically incorrect ones,
I darepost this because I am very interested in the views of other possibly affected sysadmins as well as software distributors (like HP) of programs that henceforth most likely will be deemed so called "hacker tools" and thus whose creation, distribution and usage will be prohibited by law, at least in some countries.

What grieved me, was to note by certain local press releases (unfortunately only those that probably are mostly read by IT affiliated people only) that an amendment to our criminal law ($$ 202 StGB) has passed, almost unanimously without causing the faintest debate to be noticed by the public, our Federal Assembly "Bundesrat" (Parliament of Federal States).
These new modifications to our Criminal Law, which already have been signed by our Federal President by which the final stage in our Legislative has been passed, and now only need to be promulgated to become effective,
are said to also make culpable the usage of programs and APIs such as Nmap, Tcpdump, Wireshark, libpcap, Nessus, to name but the most prominent.

Interestingly, our Federal Office for the Security of IT (BSI) still is advertising its Nessus based security scanner for the masses called BOSS on its website.

Afaik, some of the mentioned programs are also distributed by HP within their Inetrnet Express release.

My colleagues and I sometimes require to do some packet sniffing with some of these tools for trouble shooting as part of our admin work.

As far as I have seen, though I have to admit not having perused completely the legal jargon yet, there are no exemptions for some "white hat", or "ethical hacking" usage of these tools in the current caption.

I wonder how the admin job will render when programs that in the wrong hands or with nefarious intent may constitute "cyber crime"
and which will no longer be legally available while our attackers don't care anyway?

How about you?
Are there similar traits in your political environment that may impair your work?

I am also curious how vendors and distributors like HP would react.

I hope this thread will not be banned by the moderators though.

FYI, for those of you who can read German:

http://www.heise.de/newsticker/meldung/92334
http://www.bundesrat.de/cln_051/nn_6906/sid_3F08EF1F2FDE19F92588C5742985533F/SharedDocs/Beratungsvorgaenge/2006/0601-700/676-06.html?__nnn=true
http://www.bundesrat.de/cln_051/nn_8336/SharedDocs/Drucksachen/2006/0601-700/676-06,templateId=raw,property=publicationFile.pdf/676-06.pdf
http://www.bsi.de/produkte/boss/index.htm

[Ralph Grothe]

Oops, the links to the released law amendment are due to the url session id inaccessible that way.
If you are interested you must go to the starting page and search for "hacker tools" or similar.

http://www.bundesrat.de/cln_051/nn_8336/DE/Home/homepage__node.html?__nnn=true

[Anshumali]

Though the laws arent that much stringent in the country where i live, but in a global perpective, i think this is kind of too much restriction without giving a 2nd thought. If hacking has to be stopped, u need to be sure how it can be done. You need to know what all vulnerabilities exist in your infrastructure to secure them.
Most of the Security Audits firms and Security Organization rely on these tools(If not, atleast the logic) to do the network assessment . We admins use the tools for finding issues which cant be seen with default tools or not taught anywhere because thats possible with these tools like ethreal/ wireshark. Many issues which were going stray with the solution, came to sol. due to multi dimensional investigation and R&D using them.
I hope the same is the reason for HP providing them in part of its Internet Expresss Package.
"Till you know what you need to secure and how it can be stolen, you cant really secure that!!!"

Cheers!!
Anshu

[John Payne_2]

Wow, that's sure a tough one. I use tcpdump all the time to troubleshoot.

So it looks like the first thing they talk about (At least the babelfish translation seems to indicate), is the illegal use of the tools in a closed envoronment. I missed the part in it that outlawed the tools themselves, but I don't read German, so I'll have faith it's in there.

If I were presented with this problem, I would take this to my department, and get them to approve the use of the specific tools I need. Then I would be sure to use them on those boxes I had responsibility for only, and never on any others. I would also never retain any of the traces in a file past the time of the analysis.

I'm not sure how they could enforce this, especially inside a corporation that isn't willing to sacrifice their SysAdmin for doing their job.

Do you have that kind protection available in your job?

John

[Geoff Wild]

Very interesting indeed.

I wonder if the US and Canada will follow.

There is a plus side - this means that whenever a networking ticket comes in - I can send it back - stating something like "sorry, it is a criminal offence for me to resolve this issue" :)

Rgds...Geoff

[Hein van den Heuvel]

Thanks for the topic Ralph!

Security through obscurity does not work. Ever.
At best it creates a hurdle, a slowdown.
At worst some folks might be convinced they are secure.
The 'good guys' will stop using tools to identify security issues.
The 'bad guys' don't care eitherway, they'll just create a fresh, similar tool or keep using previously available variants.

Oh well,
Hein.

[Jan van den Ende]

Ralph,

Yeah,

another voice of deep concern here.

Our best help tools _MIGHT_ infringe on privacy, so: "Forbid them!"
They _MIGHT_ be used to get to "confifential" data.
So: "Forbid them!"

For comparison: Cars MAY be used to run people over. Forbid them?
Chemistry MAY be used to make poisons. Forbid it?
.. Legislation MAY be used to squeeze people. Forbid it? (Maybe THAT would be an idea to put forward to legislators!)

To put it shortly: ANY tool can be used or abused. But until recently the potential abuse of a tool has not prevented its use....
And formal abolishment has NEVER in history limited abuse, although it has severely hindered proper use.

"May you live in interesting times".

If you still have the appetite: Proost.

Have one on me.

jpe

[A. Clay Stephenson]

For those of you who have never heard the story, I suggest that you do this Google search:

+crack +"Randall Schwartz"

... and yes, it's that Randall Schwartz.

[Ralph Grothe]

Hello Guys,

thanks for sharing your thoughts.

This amendment actually is justified in its preamble as being Germany's part of meeting harmonization attempts that shall lead to a common EU law against "cyber crime".
(note, this is *my* rather liberal translation of what I understand from the legislative wording, and I have no juridical background whatsoever).
In fact the text is full of references to earlier resolutions of the EU Assembly or related panels.

So I fear that similar aproaches are already targeted (or maybe even established) in the legislation of quite a few other countries.

Maybe if you are interested enough,
you could browse the websites of your governments, parliaments or courts to find out how far similar attempts have materialized?

At least one great advantage of democracies is the fact that most of these plans and papers are made public.
Unfortunetly however, often the affected populations/electorate show very little interest.
This seems especially true for what is decided in the EU parliament and associated institutions.
Let alone the participation in EU elections is gruesome overhere.

I haven't heard yet of the prosecution of Randall for "crack"-ing passwd files on Intel servers back in the nineties.
Very interesting indeed.

[Steven E. Protter]

Shalom,

The EU or Israeli response to many issues like this is to legislate first, think later.

Something similar happened here with bank fees. The government set limits which the banks found ways around instead of openning up the market to competition.

The same thing is happening with these tools. Any tool, even the simplest can be mis-used. I mean the sendmail binary can be used to do denial of service attacks or with a script violate the canned spam act in the US. Does that mean it should be outlawed? Certainly not.

A patently idiodic response.

I used nmap to figure out the other day that a system I thought was listening on port 3389 was indeed not listening.

Nothing awful and ugly about that.

Good use of a good tool. Can it be used for denial of service? Yes. Should it be banned? No, but we'd better stay on our legistlators cases in these matters.

SEP

[Ralph Grothe]

I should add that of course none of the tools are mentioned expressis verbis in the text of the law.
But legal experts interpret that these will fall under the law unless any excemptions are made.
We'll have to wait and see how the law eventually will be carved out and actually imposed.
I think it will take a few test cases before court to get the full picture.

As an aside,
at the moment I am struggling with a minor ftp issue (see this thread if you are interested:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1151242
)
So I tried to download ProFTPD from the InternetExpress suite.
But all download attempts are in vain and I constantly get, "We are unable to process your order".
So is this merely an ordinary temporal unavailability, or have I tripped some alert wire by this thread at HPs'? ;-)

[Bill Hassell]

I have never seen any legislation by any country that is successful in it's objective to control social behavior. And especially in the area of technology. Whether it is a car or a gun or John-The-Ripper, legislators love to create a 'protective' law for dummies like us, then pat themselves on the back for a job well done. To paraphrase the old adage about guns:

"If Nmap is outlawed, then only criminals will have Nmap."

It is laughable because in their attempt to fix a criminal behavior, they are removing the ability to detect and prevent such criminal behavior. HP distributed nettl long before Ethereal and Wireshark were even an idea. What is the difference between network trace tools and a phone repairman's handset? Both are used to check the health of a communications channel, and both can be used to eavesdrop.

The only reasonable legislation is to criminalize the damage or the theft of information or systems, regardless of the tools used in the crime. This is of course nothing new (laws already exist) and therefore not glamorous for a politician. It is much more newsworthy for government to say that laws now exist which criminalize the use of certain computer tools, and we can all rest easy knowing that our fine politicians are taking such good care of us.

[Steven E. Protter]

No, I have been having periodic trouble with http://software.hp.com the past few days.

Try again later.

SEP

[John Collier]

Let's be honest for a moment.

Most of the rules/policies/laws (etc.) regarding security have actually nothing to do with security.

They are simply put in place to provide the illusion of security to the unknowing, therefore making the masses feel better.

[OldSchool]

To quote BH:
"If Nmap is outlawed, then only criminals will have Nmap."

My thoughts exactly. Legislation like this is almost always a knee-jerk reaction to a situation by legislators who must be seen as "doing something about it".

unfortunately, they are outside there area of expertice. Witness "SOX compliance audits" wherein their aren't any standards to compy with, so its whatever the auditor (usually w/ *some* knowledge of Windoze) feels is correct, as in the request to disable / rename root that was posted on these forums recently.

I live in Ohio, and for those who aren't aware their is a big flap going on here about data security. One state agency's policy was for backup operator to take the tape(s) home w/ him. One intern did so. (Can you see where this is going?) Intern's car gets broken into, tape(s) gone. State IT director: "Not to worry. Highly sophisticated device. Unlikely anyone would have the necessary hardware to read it". Dept administrator that set the policy (an outside contractor BTW) was ultimately fired, as was the intern that had the tape (which I don't get as he followed orders). Tape containes SSNs and Employer IDs of: individuals who have yet to cash state tax refund checks, payees of the state school retirement system (all of them), entities receiving state distributions (i.e. medicare / medicaid...)
State is providing ID theft "insurance". So far over $7 million USD in costs incurred.

The great thing...new governors staff had located this policy before he took office and never got around to fixing it.

Oh yeah....they had to hire yet another outside consultant (at $50 - 100k) to determine what was on the backups

but let us not have tools to do our job...it might cause privacy issues

[Pete Randall]

I expected that SANS would be commenting on this issue. Here's what they had to say in their latest newletter:

"--Concerns Raised as Germany Enacts 'Anti-Hacker' Law
(August 13, 2007)
Germany has enacted controversial anti-hacking laws which make Distributed Denial of Service Attacks and gaining unauthorized access to data illegal, with the most serious offences punishable by up to 10
years in prison. The law also makes it illegal to possess, create or distribute security tools which could be used to commit a crime. Many claim exact interpretation of the new law could criminalize security professionals who use security tools to test their systems or those of their customers. In reaction to the law, several security researchers
have shut down their German-based websites and moved them to other countries such as the Netherlands
http://www.securityfocus.com/print/brief/567
http://www.computerworld.com/action/article.do?command=printArticleBasic&articleId=9030404
http://www.theregister.co.uk/2007/08/13/german_anti-hacker_law/print.html
[Editor's Note (Pescatore): This concern has come up many times before and generally been unfounded. Laws are a blunt tool, but we do have to make sure there are legal consequences for illegal actions. After a few pieces of case law get on books sanity usually (well, at least often) reigns.
(Ranum): Every year there is some kind of yatter yatter yatter from the "security researchers" complaining that this law or that law will criminalize their tools. It's complete B.S.!!!!! No district attorney
or prosecutor is going to try to go after a security professional for using a copy of Nessus - it's simply not going to happen. What's going on, really, is that the "researchers" are worried that someone is actually going to hold them accountable for their little bags of tricks and the exploits they trade.
(Grefer): Outlawing the possession of security/hacker tools will have about the same impact on criminals as gun control legislation: none. Anybody with sufficient criminal intent will continue to obtain guns and hacking tools illegally, while the "good guys" are put at a disadvantage
when it comes to defending law and order. Bad laws are easy to come by but hard to get rid of.
(Northcutt): Keep in mind that Germany also has very strong privacy laws, so running the trail from IP address to the human actor involved in a breach is quite challenging. I think the most interesting statement is that some researchers simply move their websites to another country.
If legit researchers take this action we may see a future five or so years hence as Eastern Europe becomes less Wild West and more European Union where the hot hacking action will be centered in Indonesia or
Lesotho.]

[John Collier]

Pete,

For some reason I cannot get anything useful to pull up on your second and third links.

The second one errors out completely and the third one gives me a simple 404 error on the Register's site.

Any chance of something getting broken when you pasted them?

I would actually be interested in reading those.

[Peter Leddy_1]

John,

I had the same problem but copying the full links into my browser worked no problem.

Ralph,

Thanks for bringing this to light by the way, it will be very interesting indeed to see how the EU will deal with this in future months/years.

Regards,

Peter

[Pete Randall]

Try this one in place of the second link:

http://www.computerworld.com/action/article.do?command=printArticleBasic&articleId=9030404


Pete

[Pete Randall]

And this for the third:

http://www.theregister.co.uk/2007/08/13/german_anti-hacker_law/print.html


Pete

[Ralph Grothe]

Hi Pete,

many thanks for providing some links with comments on the new law in English.

These are a very ineteresting read.

Gathering from the interpretation of the law by the legal expert Marco Gercke it looks as if the wording indeed isn't all that clear and unambiguous as penal code should be, even for experts, and maybe only comprehensible by those.
The problem seemed to be that there was very little leeway for the German Legislator because of the tight European framework that with already considerable delay needed to be implemented quickly.
To disambiguate, so I interpret the expert,
it pretty much looks as though we need to have new precedence court cases.
The pitfall is that quite a few professional security experts and IT workers either relocate their offerings to countries that haven't been hit yet by similar laws,
or prematurely lapse into obsequious self censorship.
And there's yet another impact in further inflating our bewildering overregulation that even experts have difficulties to fathom
my country is so infamously notorious for.

Also interesting to read the expert's impression on an explicitly mentioned port scanner in his answer to the interviewer's final question:

Ok, but I have heard from multiple sources that one of the worst aspects of the new laws was that security tools such as nmap (a port scanner), would become illegal. Just having them on your computer will be enough. Is it true? Every detail about this topic would be appreciated...

Marco Gercke: The risk is there. Unlike Art. 6 of Convention on Cybercrime, Paragraph 202c Penal Code does not limit the criminalisation to tools that are primarily designed to commit certain computer crimes. Therefore it will be necessary to wait for the first verdicts. It is very likely that the courts will limit the application of the software with the result that the possession without link to criminal activities will not be punished.

[jorgeTmp]

Ralph Grothe, it's pretty interesting information to consider. But I think that we already have enough of such court cases. And you can always simply hire a professional lawyer ( like of these: https://federal-lawyer.com/employer-defense/ ), if you would have any kind of jural issues with your past employers or present ones.