U.S. And EU Ready International Cybercrime Treaty

Nightspore writes: "Yes, while you slept last night another supra-governmental body was hard at work readying a shiny new set of chains for you. Read more on how the US and EU are putting the finishing touches on their international cybercrimes treaty. The treaty will force all signatories (i.e. your government) to make illegal the 'import and distribution of devices used for hacking.' Signatories also would be required to 'provide law enforcement authorities with the ability to conduct computer searches and seize computer data.' "

Devices used for Hacking?

IE: Computers?

Cool! Where do we sign?

More than just the US and EU

The title of this article is a little misleading; in fact, the pact involves the US, Canada, Japan, South Africa, and the Council of Europe (which is a 41-country body which makes loose policy on every topic except for defense.

The Council of Europe is, therefore, more far-reaching than the EU as it includes all of those countries that didn't join the EU (like Norway). Even Moldavia and Liechtenstein are on the Council.

So, essentially, this is even worse that you might have thought. There is pretty much no "western data haven" to work from.
--

Reminder: treaties supercede constitution

A friendly reminder that ratified treaties supercede the constitution. That makes sense when the treaty ends a war and the option is rewriting the entire Constitution; it makes much less sense when it will provide a de facto end run around reasonable limits on domestic law enforcement.

Re:Devices used for Hacking?

Or brains?
--

solering irons, gdb, multimeters

I can "hack" anything with anything.

I can hack a cuecat with a soldering iron, a screwdriver and a multimeter.

I can hack a computer program with Visual Studio (built in debugger and disassembler).

I can hack a network program with ordinary windows (netmon) or unix (tcpdump/ethereal).

I can hack a lock with a paperclip.

I can hack a mixmaster with a pointed stick.

I can hack congress with a lobbyist.

I can take G. Gordon Liddy's advice for dealing with government agents storming my house.

I can move to a free country. Or maybe I can't.

___________________________

I don't believe that.

A friendly reminder that ratified treaties supercede the constitution.

I don't believe it for a minute. The Constitution holds that treaty law should be held as equal to itself. Besides, if it comes to a treaty which was ratified by the Senate, and an amendment to the Constitution which was passed by 2/3 majority of both houses of Congress AND then by 3/4 of the States, which has more backing if there is a conflict between the two?

No way do I believe that the Supreme Court would hold that a treaty overrides the Constitution. However, I sure wouldn't mind an amendment which holds the limitations the Constitution places on our government, and the rights and privileges recognized thereunder, override the terms of any and all treaties which are to the contrary. Even freedoms need backups.
--
Build a man a fire, and he's warm for a day.

International Treaty Makes Everything Illegal!

Today, in a major coup for international governments, a treaty ratified by the EU and the US (among others) officially makes everything illegal. Under the section innocently labelled "hacking devices", such obvious implements such as computers, modems and network cards are naturally banned, but so are so-called "social hacking" tools, such as telephones, pieces of paper (which may be used to write down passwords, clothing (which may be used to disguise someone), cars (which allow criminals to move to the scene of the hacking). Now that everything is illegal, everyone who is alive has been asked to report to jail, where you will be put to work as cheap slave labor for the super-mega-international-government-corporation producing inexpensive T-shirts for resale in parts of the universe that have more money.

This reporter, for one, is glad that he no longer has to worry about breaking the law-- it is with complete certainty that I can now say "No matter what I am doing, it is definitely illegal."

Re:These proposals sound resonable...

If you do something illegal on the internet... guess what? It's still illegal.

This law is like saying "it's illegal to posess any object that could possibly be used to kill someone".

Hint: that's very different from saying "It's illegal to kill someone".
--

This is technological censorship, or the beginning

You remember that slashdot article - a letter from 2020 -? Perhaps that article on NTFS-legislation is more fresh in the memory.

Hacking is defined as 'unauthorised data-access', what about reverse engeneering, what about writing a compatible protocol. Will 'patent infringement' be hacking? What about Sony Playstation emulators?

This is too bad. Supposedly, (just hypothatically) I find the magical holy grail of factoring primes... is that hacking? Can I publish this?

This is too bad, I thought I'd be safe from US laws here in Europe, reading slashdot I realize that all sorts of laws and lawsuits will deteriate my freedom. So this will change then?

What's next, regulations on internet protocols? Man is allowed to browse and mail, kill IRC, kill Napster, kill Gnutella?

This smells like a tool for technological censorship... will I need a license-to-programm in future?

Re:Devices used for Hacking?

Actually, I'd rather we ban export of people without brains. The typical US tourist seems to make the rest of us look rather sorry, so perhaps this is one good way to prevent sour international relations..

What does "device used for hacking" mean?

It also would ban the sale, purchase, import and distribution of devices used for hacking....

And in related news today: Axes, hatchets and machetes are now selling like hotcakes on Ebay in anticipation of the ban. (Time for another /. gripe fest over the meaning of the word "hacker/hacking").

Lizzy Bordon took an axe
and sunk it deep into a Vax.
When she saw what she had done
she turned and hacked apart a Sun. -author unknown

Council of Europe

The Council of Europe [coe.int] members are from many countries [www.coe.fr]:
Albania (address) Mr Paskal Milo, Minister for Foreign Affairs
Andorra (address) Mr Albert Pintat Santolaria, Minister for External Relations of the Principality of Andorra
Austria (address) Mrs Benita Ferrero-Waldner, Federal Minister for Foreign Affairs
Belgium (address) Mr Louis Michel, Minister for Foreign Affairs
Bulgaria (address) Mrs Nadezhda Mihailova, Minister for Foreign Affairs
Croatia (address) Mr. Tonino Picula, Minister for Foreign Affairs
Cyprus (address) Mr Ioannis Kasoulides, Minister for Foreign Affairs
Czech Republic (address) Mr Jan Kavan, Minister for Foreign Affairs
Denmark (address) Mr Niels Helveg Petersen, Minister for Foreign Affairs
Estonia (address) Mr Toomas Hendrik Ílves, Minister for Foreign Affairs
Finland (address) Mr Erkki Tuomioja, Minister for Foreign Affairs
France (address) Mr Hubert Védrine, Minister for Foreign Affairs
Georgia (address) Mr Irakli Menagarishvili, Minister for Foreign Affairs
Germany (address) Mr Joschka Fischer, Minister for Foreign Affairs
Greece (address) Mr Giorgos Papandreou, Minister for Foreign Affairs
Hungary (address) Mr János Martonyi, Minister for Foreign Affairs
Iceland (address) Mr Halldor Asgrimsson, Minister for Foreign Affairs
Ireland (address) Mr Brian Cowen, Minister for Foreign Affairs
Italy (address) Mr Lamberto Dini, Minister for Foreign Affairs
Latvia (address) Mr Indulis Berzins, Minister for Foreign Affairs
Liechtenstein (address) Mrs Andrea Willi, Minister for Foreign Affairs
Lithuania (address) Mr Algirdas Saudargas, Minister for Foreign Affairs
Luxembourg (address) Mrs Lydie Polfer, Deputy Prime Minister, Minister for Foreign Affairs, External trade.
Malta (address) Mr Joe Borg, Minister for Foreign Affairs
Moldova (address) Mr Nicolae Tabacaru, Minister for Foreign Affairs
Netherlands (address) Mr Jozias van Aartsen, Minister for Foreign Affairs
Norway (address) Mr Thorbjørn Jagland, Minister for Foreign Affairs
Poland (address) Mr Bronislaw Geremek, Minister for Foreign Affairs
Portugal (address) Mr Jaime José Matos Gama, Minister for Foreign Affairs
Romania (address) Mr Petre Roman, Minister for Foreign Affairs
Russian Federation (address) Mr Igor Ivanov, Minister for Foreign Affairs
San Marino (address) Mr Gabriele Gatti, Minister for Foreign and Political Affairs
Slovak Republic (address) Mr Eduard Kukan, Minister for Foreign Affairs
Slovenia (address) Mr Dimitrij Rupel, Minister for Foreign Affairs
Spain (address) Mr Josep Pique i Camps, Minister for Foreign Affairs
Sweden (address) Ms Anna Lindh, Minister for Foreign Affairs
Switzerland (address) Mr Joseph Deiss, Head of the Federal Department of Foreign Affairs
"the former Yugoslav Republic of Macedonia" (address) Mr Aleksandar Dimitrov, Minister for Foreign Affairs
Turkey (address) Mr Ismail Cem, Minister for Foreign Affairs
Ukraine (address) Mr Borys Tarasiuk, Minister for Foreign Affairs
United Kingdom (address) The Rt. Hon. Robin Cook, MP, Secretary of State for Foreign and Commonwealth Affairs

___________________________

Re:Reminder: treaties supercede constitution NOT

Treaties do not supercede the constitution, as it, and only it, is the supreme law of the land.

Article 1, Section. 10,Clause 1: No State shall enter into any Treaty, Alliance, or Confederation; grant Letters of Marque and Reprisal; coin Money; emit Bills of Credit; make any Thing but gold and silver Coin a Tender in Payment of Debts; pass any Bill of Attainder, ex post facto Law, or Law impairing the Obligation of Contracts, or grant any Title of Nobility.

Article 2, Section 2, Clause 2: He shall have Power, by and with the Advice and Consent of the Senate, to make Treaties, provided two thirds of the Senators present concur; and he shall nominate, and by and with the Advice and Consent of the Senate, shall appoint Ambassadors, other public Ministers and Consuls, Judges of the supreme Court, and all other Officers of the United States, whose Appointments are not herein otherwise provided for, and which shall be established by Law: but the Congress may by Law vest the Appointment of such inferior Officers, as they think proper, in the President alone, in the Courts of Law, or in the Heads of Departments.

Article 3, Section 2, Clause 1: The judicial Power shall extend to all Cases, in Law and Equity, arising under this Constitution, the Laws of the United States, and Treaties made, or which shall be made, under their Authority;--to all Cases affecting Ambassadors, other public Ministers and Consuls;--to all Cases of admiralty and maritime Jurisdiction;--to Controversies to which the United States shall be a Party;--to Controversies between two or more States;--between a State and Citizens of another State; (See Note 10)--between Citizens of different States, --between Citizens of the same State claiming Lands under Grants of different States, and between a State, or the Citizens thereof, and foreign States, Citizens or Subjects.

And the kicker:

Article 6, Clause 2: This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.

___________________________

Re:Drawing the line

Well, here's [coe.int] the first draft. The article says they're nearing a final draft, so this one might not be right (anyone find a better one?)

• 
  a. the production, sale, procurement for use, import, distribution or otherwise making available of:

  1. a device, including a computer program, designed or adapted [specifically] [primarily] [particularly] for the purpose of committing any of the offences established in accordance with Article 2 - 5;

  2. a computer password, access code, or similar data by which the whole or any part of a computer system is capable of being accessed with intent that it be used for the purpose of committing the offences established in Articles 2 - 5;

  a. the possession of an item referred to in paragraphs (a)(1) and (2) above, with intent that it be used for the purpose of committing the offenses established in Articles 2 - 5. A party may require by law that a number of such items be possessed before criminal liability attaches.

Sounds just like the DMCA's defintion [cornell.edu] about what a copyright infringement device is. So this type of law now will extend from only covering copyrights to covering anything that was intentionally locked. Which would probably cover the CueCat (keep those articles coming!)

(please note: offline lockpicks are not illegal. online ones will be illegal soon.)
--

Re:More than just the US and EU

Thus, third world countries can make lots of money by being data havens. The knowledge gap meets the freedom gap.
--

-Why- this is bad...

'Laws' being proposed are,
People with access to information must make all reasonable effort to provide it to the authorities. Ie, 'We need to see all your server logs because we think the cracker routed through your network' or 'We need your entire anonymous remailer database so we can do traffic analysis to determine which 17 accounts belong to the cracker'; With a warrant... without... ? Will it be a 'crime' to not turn over this information on request? (Well, not for long in the USA but who knows about other countries; the courts will make sure warrants and/or subpoenas are still required to coerce information, but it could take time if the law isn't written that way.)

'Cracker Tools' being outlawed; to draw an analogy, 'lets outlaw drills because they can be used to drill out lock cylinders and gain entry into people's houses!' Uhm. What's a 'computer hacking tool' anyway? Netcat? I'm using it right now to test ftp protocols by hand. nmap? I use it to check that I didn't miss any ports when locking down a box. Nessus? Satan? They'll tell you exactly where a machine is vulnerable. Your machine, somebody else's machine, how are they supposed to know? (Actually, with Nessus you already have to be inside the target to use it, though I'm sure it could be used as a codebase to start a dedicated cracking tool.) My point is, run a security 'auditor' in combination with a 'stealth' portscan and compile a handful of 'demonstration' exploits from securityfocus and you've got yourself a handy-dandy skr1pt k1ddy level cracking-kit built out of security admin tools. Never mind the prior restraint/free speech issues implied since code is text is speech, dammit.

'Illegal to do unauthorized access' ... What's an unauthorized access? Pinging a machine? Reading a webpage meant for internal use but not secured? Attempting to log in as user 'ftp' on a non-public ftp server? Portscanning? What is a portscan? Does telnetting to ports 21, 23, 25, and 80 out of curiousity to see what they're running count as a 'portscan'? D'oh.

If you ask me, the only 'computer crime' law we need is to make it illegal to destroy or alter information on a computer that you don't have authorized access too, (where 'alter' does not include doing things that generate log entries, etc, etc, long list of exceptions to describe normal behaviour). Yeah, this means if someone cracks your computer without overwriting files or anything nasty like that (like, maybe they sniff your in-the-clear telnet or ftp password transmission...) that you can't do jack about it in court, but so what?
Everyone always wants to draw parallels to the real world: In the real world you don't arrest people for walking into the lobby; you don't arrest people for using the bathroom without buying anything even though it says 'customers only'; you don't arrest people for looking in through the window of a jewelry store or even rattling the cage over the windows. You -do- arrest people for spray painting on the walls of the bathroom or for throwing a brick through the window of the jewelry store and running off with a pocketful of diamonds. Where the access lines between 'use' and 'abuse' are is entirely too vague and if we're not careful the government(s) will write up a set of laws that making any new network protocol illegal - not by intent, but because they're politicians and lawyers, not engineers, and won't know the implications of what they're writing! (Presumably they have enough technical advisors to know the -explicit- meaning of what they're writing, but long term implications are another matter.)

Any-way. The article is very vague; maybe safeguards are being built in to prevent the worries I describe; maybe they aren't; maybe they're penciled in but maybe they'll get erased; keep an eye on it, anyway, because it is -not- 'mostly harmless'.


--Parity

Re:Reminder: treaties supercede constitution

It says,
'The constitution, and laws made by the rules of the constitution, and treaties made by the USA, together make up the supreme law, and all judges are bound by it, no matter what the state laws and state constitutions of the individual states may say.'
Or in other words, the constitution + federal law + treaties are bigger and badder than state laws and state constitutions; it doesn't say where treaties are relative to the federal constitution... though since the only thing that gives treaties power is the constitution -saying- they have power, there's a certain implication there...


--Parity

No, treaties DON'T override the constitution.

This constitution, and the laws of the United States which shall be made in pursuance thereof; and all treaties made, or which shall be made, under the authority of the United States shall be the supreme law of the land; and the judges in every state shall be bound thereby, any thing in the constitution or laws of any state to the contrary notwithstanding.

Emphasis mine. See? Even the constitution takes a back seat to any agreements made in treaties.

That is incorrect. It's a very common error, and comes from misparsing the sentence. The same misparsing could be used to say that federal law overrides the constitution, or that the constitution overrides itself.

What it REALLY says is that the (federal constitution, federal laws, and treaties) override state (constitutions and laws).

Re:Drawing the line

The Locksmithing FAQ [respublica.fr] says:

• 3. Is it legal to carry lock picks?

• This depends on where you are. In the U.S. the common case seems to be that it is legal to carry potential "burglar tools" such as keys, picks, crowbars, jacks, bricks, etc., but use of such tools to commit a crime is a crime in itself. Call your local library, district attorney, police department, or your own attorney to be sure. Possession of potential "burglar tools" can be be used as evidence against you if you are found in incriminating circumstances. An example of a state law can be found in the Viginia State Code: Section 18.2-94 _Possession of burglarious tools, etc._ "If any person have in his possession any tools, implements or outfit, with intent to commit burglary, robbery or larceny, upon conviction thereof he shall be guilty of a Class 5 felony."

  Note that the prosecution has to prove "intent". However, the law continues: "The possession of such burglarious tools, implements or outfit by any person other than a licensed dealer, shall be prima facie evidence of an intent to commit burglary, robbery or larceny." This means that the possessor can have a bit of an uphill battle and has to convince the jury that this 'prima facie evidence' is misleading.

  Places where it *is* illegal to carry lock picks: The District of Columbia, New York State and Illinois. New Jersey law appears to make these illegal if they can work motor vehicle locks. There may be many other places as well (such as Canada, Maryland and California.) It can be hard to tell since the relevant laws can be dealing with burglary, motor vehicles or locksmith regulation, etc. This emphasizes the importance of finding out for *your* area - and determining the applicability to *your* circumstances (e.g., locksmith, full or part-time), repo worker, building maintenance worker, ...

--

Re:hmmm...

Your're right - sort of. The biggest problem with laws like this is that "hacking tools" is obviously too vague. And vague laws are a license for selective enforcement - a way to get people thrown in jail when they have an attitude that powerful people don't like.

Owning computers, compilers, debuggers, and the like will be legal - until you do something with them that some government agency or big company doesn't like. Then they will call it "hacking" and the fact that you have those tools will be proof that you are a criminal.

Under a law like this, the people that reverse engineered CueCat could be charged with possession of hacking tools - the same software that millions of other people have - but their knowlege and application of those tools will magically make the tools themselves illegal.

I figure it will be time to leave the US and move to a free country in about 5 years at the rate things are going. Hope there are some free countries left by then.

Torrey Hoffman (Azog)

"Hacking" is not in the proposed treaty.

The text of the treaty does not use the term "hacking". That occurs twice in the editor's comments, and nowhere else.

The treaty explicitly defines the classes of crimes in question.

There's some bad stuff in there. But it's not QUITE as bad as the article makes it sound.

(One example is the section on seizure, which includes deliberatly denying access to the siezed data.

In the US, seizure as part of a search is supposed to be only to preserve evidence. Denial or disruption of access to the seized material is only authorized when it's an unavoidable consequence of preserving the evidence, and copies of the data siezed must usually be made available to the data's owner at some point in the proceedings.)

Re:No, treaties DON'T override the constitution.

A lot of people are arguing over this, so maybe some facts will help.

Reid v. Covert (1957) Supreme Court [puertorico51.org]

• When the United States acts against its citizens abroad, it can do so only in accordance with all the limitations imposed by the Constitution, including Art. III, 2, and the Fifth and Sixth Amendments. Pp. 5-14. [354 U.S. 2]

Commentary on the case here [pitt.edu].
--