Paper: "Cybercrimes: A Practical Approach..." 44
tgeller writes "The Santa Clara Computer High Technology Law Journal just published a paper by lawyer Eric Sinrod and William P. Reilly: "Cybercrimes: A Practical Approach to
the Application of Federal Computer Crime Laws". The 54-page paper gives an excellent overview of computer crime methods, legal remedies, and motives. And he gets the "hacker/cracker" distinction right! Download the PDF or Word version (sorry, no hypertext)." Good background info if you are interested in this.
Comment removed (Score:5)
Re:hacker (Score:1)
Well,
It used to be true that hackers needed to be skilled and were primarily interested in learning. Not anymore.
Why, in my day, we used card punches! And Liked It!
--
Greetings New User! Be sure to replace this text with a
They did *not* get "Hacker" right (Score:3)
In other words, they manage to abuse citations of both the Jargon File andLevy/TMRC in general to spread the popular but incorrect definition of Hacker as a Person Who Breaks Into Computers.
To pour salt into the wound, they then go on to define Crackers as a specific subset of Hackers ("Hackers with criminal intent"), that is, People Who Break Into Computers For the Purpose of Committing a Crime.
Topping it off, they actually include the Jargon File definition in their appendix, as if to mock their reviewers who didn't bother to check it to see if it said what they said it said (it doesn't).
Argh.
Re:Can I? (Score:1)
What about the use of "e" as a prefix?
It really makes me e-mad to see all of the e-companies and e-businesses making all sorts of e-jargon useing the "e" as an e-prefix. It seems that every e-billboard I see has an e-advertisment e-spouting the e-value of every e-product they e-sell.
its e-driving me outta my e-freaking e-mind
I've had e-nough of it all!
Re:This is getting absurd (Score:1)
Here's an HTML version. (Score:4)
The HTML file is here [hypermart.net] and the zipped HTML file is here [hypermart.net].
--
Ants trying to hold back a tidal wave (Score:3)
Talk about trying to hold back the rising tide. How many police departments with mega-brilliant networking specialists are there in the world, and how many lawyers and judges are there with even the remotest comprehension of the issues involved? Sure, there are some
Estimating the number of active crackers or attackers is difficult, but clearly the number is large even today. With eventual total Internet populations heading into 9 or even 10 figures, the number of cases is going to exceed any possibility of legal enforcement by huge orders of magnitude, if they don't already. In this area, the law is like ants trying to hold back not just the tide but a tidal wave.
Needless to say, the legal profession doesn't like to admit that it is utterly powerless already in any practical sense, let alone that the situation in just a few years time will be massively worse. Academic papers like this (in the worst sense of academic) probably get written by well-intentioned people in the hope that it'll help, but this is a case of massive self-delusion. The numbers just don't add up.
Cybercrime Article (Score:3)
Re:Suspect opening sentence (Score:2)
Re:Can I? (Score:1)
Difference Between Murder and Software Piracy... (Score:5)
I consider it a protest against the perversion of copyright and other IP laws by big corporations which are insinuating themselves into positions of undue influence in government; corporations have vastly more resources than individuals, and as such individuals can no longer influence their government to such a great extent as corporations can.
The whole notion that IP no longer passes into the public domain after a reasonable period of time in which its creators can derive profit, but instead remains locked up for 100 years after the death of the creator, is deplorable. Corporations like Disney made their fortunes by using public domain IP (half of Disney's cartoons are from other people's stories, used for free) which they'd have never been able to use under the IP law they've now implemented to keep their own creations indefinitely instead of giving back to the public domain they so richly borrowed from. The music industry is similarly guilty.
As such, it's a valid form of protest to pirate mp3s and DivX of songs and films created by companies which have taken from public domain IP but never contributed back. Real cybercrime involves matters more serious than trading mp3s privately rather than for profit.
Even more, I object to the notion in the paper referenced that it's a bad thing that "many countries do not share the urgency to combat cyber-crime for many reasons, including different values concerning piracy and espionage or the need to address more pressing social problems." That's one of the things I dislike most about the U.S.: cultural imperialism. The U.S. government has a tendency to try to push its own values and legal precepts onto other nations, and that's just plain wrong. Unless human rights are being violated in a very fundamental way, the U.S. has no right to attempt to coerce other countries into accepting our own cultural values.
For example, if a sovereign nation wants to adopt a policy which makes all IP public domain within a few years, that's the right of that nation to do so. Originally, copyrights in the U.S. lasted only 14 years. But instead the U.S. tries to put pressure on such countries, or else bribes them with "humanitarian" grants into accepting the U.S. position. Would we allow the largest corporation in the U.S. to bully all others into adopting particular strategies, dividing up markets, and bribing competitors into submission? No. So, why is the U.S. allowed to dictate its values to the rest of the world?
This is important because "cybercrime" as it's defined now in the U.S. includes matters which are legal in other nations, and the U.S. is attempting to pressure other nations into accepting U.S. offenses as international ones. Most of this pressure comes from the far right in this country, who are campaigning against pornography and recreational narcotics as well as trying to extend corporate hegemony.
One of the prime examples is the U.S. characterization of the Netherlands as being the largest producer of child pornography and a major point of interest in drug trafficking. Since the Reagan-Meese morality policing of the 80s, The Netherlands has been in FBI reports as the largest producer of child pornography, because the age of consent for porn in The Netherlands is 16 rather than 18. Rather skewed to call that child pornography, merely because cultural attitudes toward sex are more permissive in one country than in the most puritanical one on the planet. Also, The Netherlands actually has very strict controls placed on marijuana, which is legal to purchase in certain locales even though it's not legally easily exportable or even transportable within the country itself. That's similarly no reason for FBI reports to classify The Netherlands as a notable place for drug trafficking.
The Netherlands was replaced by Japan in FBI reports on cybercrime as the largest producer of child pornography, despite the fact that once again a cultural difference comes into play. Japan has never suffered the same sexual repression/oppression that some Western nations such as the U.S. have suffered, due to huge religious and cultural differences, hance the age of consent for pornography was lower than 18. The U.S. applied economic and political pressure to force the sovereign nation of Japan to raise its own internal age of consent for pornography production, which regardless of one's own attitudes towards sex or pornography is an inappropriate thing for one nation to do to another. Japan happily has no stigma attached to sex, and no Puritanical expectation of chastity until marriage. To include what is legal in its own nation and hosted in its own nation in cybercrime statistics is both cylturally imperialistic and dishonest.
This hasn't even touched upon the Chinese attitudes toward piracy of music and film, which would never be allowed by the U.S. to continue were it not for the fact that China is one of the most powerful nations. Were it a small, average country, the U.S. would have pressured them and economically blackmailed or bribed them already to buy into U.S. cultural values on the subject.
While the paper's details about various cracking exploits and their relationships with applicable federal laws is informative, I find its nonchalant inclusion of software piracy together with extortion and money laundering and fraud to be laughable, and its comments about laws which diverge in other countries from U.S. law to be downright offensive. It's extremely selfish and culturally imperialistic to assume that American ways are right and any others are wrong and still to be considered illegal even when permitted in the country in question. And anyone who wants to know why I harped on the differing definition of child pornography in the U.S. and in other nations, it's because the FBI likes to artificially inflate those figures in order to make the threat appear more significant than it is, in order to secure more of our tax dollars and to get away with more abuses of civil rights--after all, when anyone mentions children people start being emotional instead of rational. More about that here at this link. [slashdot.org]
Re:Suspect opening sentence (Score:1)
Re:Difference Between Murder and Software Piracy.. (Score:2)
Personally I feel that many people, particulaly those in the US, seem to feel that the internet belongs to their country. I'll try not to single out the USA because the same thing does happen here... until about last week britain did have very strict regulations on obscenity and yet still allowed girls of 16 to appear in soft pr0n.
What does annoy me is that some US companies use
C|Net sweepstakes is a prime example. They are quite happy to spam my
A real life example of this would be having a shop that didn't let people from china enter it!!
Re:Double standards on hacker/cracker distinction? (Score:1)
Re:Prevention and Prosecution (Score:2)
a legal solution requires manual intervention for every incident, while a technical solution, even with a higher up front cost, will counteract each attack automatically
Re:Disagree (with reservations) (Score:2)
This was one reason why I was suprised that earthlink was allowed to not install carnivore but instead perform the logging themselves.
I know if I were ever prosecuted with virtual evidence (e-evidence?) I'd do my damndest to expose all the holes in the chain of gathering that evidence.
Even if carnivore's in place, it's results are only as good as the data it's being sent.
Hrm. Not sure it starts out that well. (Score:2)
anyway, just a nitpick. It's not like I'm gonna read a 54 page legal document. but skipping to the conclusion, we see
So it looks more than a little clued in. Ugh. maybe i'll print it out for the T ride home. But 54 pages. Man. they need page limits...[cr|h]acker almost right, then blows it (Score:4)
They almost got it right, but then the report throws the underground movement in with the creative hackish crowd. Granted, they mostly go together, but I'd have associated DefCon, HacTic, CCCC, HOPE and the other cons with the cracker crowd. I've been to many of the cons in europe and the US, and ALL the discussions revolved around criminal activity, NONE of it was about building better IP stacks or the pros and cons of threads in kernel space.
The rest of the report uses Hacker in place of the term cybercriminal.
In the middle of page 20 is a distorted look at a TCP intercept attack. It isn't necessary to DoS computer B to predict a TCP sequence number and redirect the TCP flow to computer A. There seems to be a lot of misunderstandings like this through the rest of the report.
All in all, this is an excellent look at the type of information used to train law enforcement. This is the level of detail they are taught, and then they have to extrapolate this to each case they handle. They even quote a 20 year old entry in the Jargon Dictionary that telnet on a TOPS-10 is called IMPCOM. Any
the AC
Re:Word history (Score:1)
wish
---
Re:New Laws? (Score:2)
I'll put my views of the justice system aside for a moment and just say that if they want to carry on the way they're going, looking at different types of crimes in a different light (and in different laws if need-be) is not a bad idea.
Re:OOGs journey (Score:1)
if it ain't broke, then fix it 'till it is!
text version (Score:4)
http://cow.mooresystems.com/~amoore/cybercrime.txt [mooresystems.com].
If the author would like this copy removed, please mail me. I would be more than happy to remove it.
At least he *mentioned* the right definition (Score:2)
So, I wonder why after he goes through the trouble of getting the correct definition he continues to refer to "hackers" throughout the article.
SysAdmin Responsibility (Score:4)
All in all, this looks to be the equivalent of a Processing Crackers HOWTO, for either Law Enforcement or for corporations.
One of the problems I have with this article, is that it outlines all the different laws applicable where either the District Attourney or the corporation can prosecute, but it only goes very briefly or not at all into how a SysAdmin can actually stop these attacks.
All of these attacks can be stopped if the sysadmin is doing his job correctly. Especially if the sysadmin can be held legally responsible for attacks mounted from his system, he MUST keep on top of these things.
Obviously the article is meant to focus on the legal issues, and it can be a useful resource for someone who has already been compromised. But I know that whenever *I* as a sysadmin have a successful attack performed against *my* system, I am grateful for the heads up. Unless there is *real* and measurable damage (for instance stealing all the users' credit card numbers, etc) I do not believe in prosecuting the "hacker". YMMV.
------------
Re:This is getting absurd (Score:2)
we need to enforce the laws that we already have! (Score:1)
Legislators don't normally think this way, as most feel that their job is to push forward new legislation, but we need to concentrate on enforcement of current laws.
Maybe even remove some of the archaic laws on the books...
Don't we have a higher percentage of people in prison than any other large country?
---
Interested in the Colorado Lottery?
Disagree (with reservations) (Score:2)
Sysadmins already cooperate well together. Possibly not well enough yet, and some things need to change. If someone emails me and say's 'One of your boxes is DDoSing one of mine (not happened -yet) I *hope* I would bring the offending (cracked) box down fast, make the logs etc. available to law enforcement people and generally try to nail the criminal. In return, I would expect a level of diligence from law enforcement people to prosecute the perpetrator hard. We don't need draconian penalties. Just make them totally liable for all costs and ban them from access to the net for a period.
One of the major problems is getting evidence that is acceptable in a court. Lawyers will do anything to discredit evidence if there is the *slightest* chance it might have been tampered with; and we all know how hard it is to modify a logfile.
The laws are there. Let's use them.
News Flash! (Score:1)
In other breaking news, Playboy Magazine publishes photographs of nude women, and the Wall Street Journal has printed yesterday's closing NYSE stock prices.
We will continue to report on these shocking events as they unfold.
Pozitiv affect (Score:1)
Re:Can I? (Score:1)
Prevention and Prosecution (Score:3)
When I was a contractor for a major US Government organization, I used to attend monthly security meetings. These meetings were open to contractors as well as Civil Servants - attendies included a select few who's job was security, a handfull of admins interested in security, and a larger number of those less technically oriented but tasked to "do something" about the environments they were responsible for.
Common patterns formed each meeting.
In one example, one of the people in charge would bring up an incident or vulnerability they were concerned with. The techies would pipe in with comments and occasionally hijack the meeting with a discussion. The non-techies (mostly management) would stare at the whole proceeding with glazed eyes and confusion. Occasionally they would wince at what the technies were suggesting should be done or scoff at the costs and lack of funding for such activities.
Other times, our special guest from the local federal investigative function would begin to talk about prosecution. Comments and discussion would soon follow... but no longer did the techies have control of the meeting. It was the non-technical management corp that lit up with enthusiasm.
Technical issues are hard for the non-technical to grasp. In many organizations, it isn't the technically adept who are responsible and pressured to "do something". Faced with this ultimatum, its much easier to jump in to the physical world of prosecution than the archane technical issues involved.
The sad part of this experience is that if the same amount of enthusiasm, man hours, and funding went to solving the technical issues of information security... much of the prosecution wouldn't be neccissary. The environment would have been secure enough to avoid most incidents.
Re:Double standards on hacker/cracker distinction? (Score:1)
That's a good point, but perhaps part of the reason we don't bitch and moan at 2600 is that they know the distinction. We know they know it. Mainstream journalists, lawyers, et al, are more often ignorant of the distinction. If we bitch and moan at them, they might learn the distinction. We really can't force anyone to use terms correctly; we can only try to teach the correct definitions.
OTOH, perhaps we're just afraid of harrassing the 2600 people because we don't want to be 0wn3d? :^>
Suspect opening sentence (Score:2)
Um, does anyone else see this as an inauspicious beginning to a 50-some-odd page paper on computer security? (yes, I did go on to read the rest of it) That first sentence is one of the grossest generalizations I've seen recently. "disaffected genius teenagers" is bad enough, but as portrayed in Hackers?????
OTOH, I agree with the second part of the sentence. I would be very surprised if the Internet could be completely destroyed by cybercrime, because I believe that it is a resiliant entity and enough intelligent people are involved. Damaged? Certainly. Disrupted for a couple of days? Definitely.
Re:Disagree (with reservations) (Score:1)
More importantly, we can't rely on governments to regulate the net because they don't understand it! They are old systems devoted to taking years to make a decision and even longer to change their minds, if you can convince them to do so.
Unfortunatly, it's hard to get any real security for a system because we don't have access to all the tools we need, or because we have other issues to be concerned w/ (ie: the classic usability vs. security issue) so, we are forced to rely on the govenments. This of course only works if you have money for lawyers and such, and in the case of the US, LOTS of money for lots of lawyers.
Anyone have a good answer?
Finally! (Score:1)
New Laws? (Score:2)
-
It needs to be pointed out. (Score:4)
choice of movies (Score:2)
I would have thought "War Games" and "Sneakers" maybe, but "Hackers" ?? Give me a break.
That's like mentioning a Honda Civic in a paper about exotic cars.
wish
---
Word history (Score:1)
Can someone who downloads the Word version check?
Just a thought.
This is getting absurd (Score:1)
Can I? (Score:2)
William Gibson has a lot to answer for.
hacker (Score:1)
I'm not too sure about the "skilled" part. And, I'm also not sure about the "how they work" part, either.
Double standards on hacker/cracker distinction? (Score:2)
oops--typical arrogant american (Score:1)
I know that slashdot is an international community...
---
Interested in the Colorado Lottery?