Hacker News Reader

Comment by teekert | Hacker News Reader

It's nice, meanwhile "we" now have a law being debated by government (not sure it will pass) that allows the government to hack individuals if they are suspect, this may even happen via people the suspect may know. It even includes being allowed to install spyware on a webcam.

But I guess it is good to leave encryption strong, forget about mass surveillance and focus energy on individuals actually suspected of a crime.

The cynic in me thinks the reasoning was: "We need a European Google", "We see that Europeans distrust American companies because of NSA economic spying in the past", "Let's make the Netherlands more attractive for large European companies"... no Idealism involved.

Edit: Updated original post: This new law ("Wet Computercriminaliteit 3") has not been passed yet!

View on HN

As an American unhappy with the way our government is heading (backdoors in encryption), I would love to see a "European Google". I am certainly no expert in laws in the EU but, as I understand it, the data protection laws there are actually pretty good. I would much rather handle/host my data in countries where the companies are held to these standards.

If there is a reasonable suspicion I don't see the problem with giving law enforcement the legal ability to hack their targets. This is something very different from drag-net surveillance and should not be tainted with the same stigma. It's not like the government actually _needs_ or wants to maintain giant botnets of all the targets they've hacked.

Withholding known security vulnerabilities from the public in order to be later used for hacking is immoral and dangerous.

Imagine if the police had prior knowledge of a vulnerability in the computer system of a car, but did not act to protect the public. A few years later a criminal figure out the same vulnerability and causes a major car crash on a motorway and murder several people. I would view the police officer to be found liable under breach of duty, same as if they witnessed a crime and refused to act.

Under the same logic, if companies has a legal responsibility to protect their customers and provide safe products, and police officers has a professional responsibility to report crimes, then the police should be forced to act if they have confirmed information about a security vulnerability.

> if companies has a legal responsibility to protect their customers and provide safe products

Since 1 January there is also a law in the Netherlands that requires companies to report any data leaks.

https://www.government.nl/latest/news/2015/07/10/obligation-...

A data leak is not the same as a security vulnerability. The data leaks refer to organisations having customer data which is hacked. They have to report this. This doesn't cover finding a leak in Flash.

Withholding known security vulnerabilities from the public in order to be later used for hacking is immoral and dangerous.

I was thinking about this when Anonymous "hacked" thousands of ISIS twitter accounts. On the one hand that saves Twitter from having to make a stand themselves - but if they didn't immediately plug those holes, they're leaving legitimate users at risk.

If such a thing is allowed, then higher standards should be applied to forced digital entry by police than are applied to forced physical entry.

Also, one very bothersome side effect of government-sanctioned hacking is that governments have an incentive not to notify software vendors about vulnerabilities.

Without knowing the details, I think this sounds fine as long as there is reasonable suspicion, it is approved by a court or judge, and a warrant is issued to conduct the surveillance.

Indeed, it is the way to go imo, it is akin to a steak-out, hacking friends and family though... a bit fishy.

Yes, you most definitely should not target people not suspected of a crime.

This seems to go against the Dutch Constitution, so hopefully people are fighting this.

Reply on news.ycombinator.com