Hacker News Reader

Comment by wongarsu | Hacker News Reader

> In the new situation, hacking, targeted interception and data access operations get an automatic extension beyond the actual target of the warrant. If a warrant is requested to intercept the communications of a specific hacking organization, the warrant now also extends to victims of this hacking group. Or, more concretely, if your computer gets hacked by group X and there was a warrant to intercept the traffic of group X, the Dutch services now gain automatic approval to also intercept your communications or hack you.

I guess I can see that being useful occasionally, but it also seems ripe for abuse. Just plant a mole in a hacker organisation of your choice, get a warrant against them, and now you can have your mole hack whoever you like, giving you the automatic right to hack them and intercept their communications

View on HN

How about asking the hacked person for permission to access their (other?) communications to prosecute the hacker? Too simple? Doesn't scale automatically? But if the latter is the case, it's not something to be used sparingly.

I'm guessing they don't want the target to know they are hacked.

That should not be allowed. Police should give discloser.

> That should not be allowed. Police should give discloser.

This obviously cannot be a boundary condition for policing; it's adversarial. The question is whether this balances public needs against private rights. My gut feeling is the extensions should require court approval or disclosure.

We're talking about disclosing to victims here. There should be no adversarial relationship between the police and a hacking victim that I can see.

An organisation might hack some of its allies, who would act as a contact canary. Reporting contact by the police to their friends.

It is an adversarial game. The hackers could plant fake victims as monitors for police activities. This is an important reason why the police can't disclose to the victims that they were hacked or how they were hacked. However, I think we could at least make the laws such that the police can disclose certain information upon request post mortem. Absolutely not during investigation.

This seems like a better check on the authoritative power imo. It can come with gag orders and so on. But no free citizen's property should be seized without explicit permission or extreme circumstances. But I don't know if the Dutch has anything similar to the US's 4th amendment (against unreasonable search an seizures). I'd still argue that you're not free if the government can just seize your things when you have not broken any law, and don't feel like that's a high bar. And we all know Goodhart, so I'm sure someone will exploit this like the parent suggested.

> I'd still argue that you're not free if the government can just seize your things when you have not broken any law, and don't feel like that's a high bar.

I was wondering how this would fit if an entity like equifax wanted to hide a data breach. However, reading your statement again, failure to report a security breach is unlawful in all fifty states as far as I can tell from a Google search (I anal, I don't know the law) so I'd imagine EU laws would be at least as strong as this.

With that out of the way, yes, I am ok with this.

This is like you getting mugged and the police stealing your car afterwards.

> It can come with gag orders and so on

Those are not really a thing in the EU (at least, not for regular police)

> you're not free if the government can just seize your things when you have not broken any law

This is something that can and does happen in the Netherlands, f.e. when the government feels they need to destroy your apartment and build a new one (as part of gentrification, generally). They are tangentially required to get you replacement housing, but not at the same price or in a similar location. Thus, not in any practical sense. If they cannot find this for you they will still kick you out and where you will live after is your problem.

> I don't know if the Dutch has anything similar to the US's 4th amendment (against unreasonable search an seizures).

The Netherlands is party to the ECHR. Article 5 through 8 inclusive are relevant, especially Article 8.

The Dutch constitution may also cover this ground, but I'm not familiar with it.

Thank you. I'm actually a bit surprised how close some of these read to US amendments.

Though reading Article 8 -- Right to respect for private and family life -- I'm not sure if this matters IANAL

> 2. There shall be no interference by a public authority with the exercise of this right __except such as is in accordance with the law__ and is necessary in a democratic society __in the interests of national security, public safety__ or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others

That feels like as long as it is the law then it doesn't violate Article 8. Seems that saying it is for public safety is also another way to get around this. I also noticed this in Article 11 (right to assembly) and some others. Not being a lawyer, these seem pretty non-binding.

Yes, unfortunately there's the potential exception you see. The European interpretation of rights is that they're balanced against each other, as opposed to absolute.

The good news is that “necessary in a democratic society” is a high bar. Thankfully there have been several successful challenges to government mass surveillance in the past, under this Article.

Unfortunately, proposals like this keep coming back, and you never know what way a court will rule.

This doesn't scale. The fbi has tried for years to cooperatively remediate US businesses who have been hacked. And not just carders, although those too- but actual apts pursuing national security goals. And the frank news is that these businesses do not care. It isnt their responsibility, and they do have responsibilities.

The infosec goobers on HN are about 5 years behind the times. Since about Obama (when the fbi started doing this in the us) it's been clear that the whole name/shame won't cause orgs to do better. Publishing active proof of concepts for exploits will not cause orgs to patch. It will take national legislation giving people federal-pound-me-in-ass-prison to get them to enforce cybersecurity.

I'll take it a few steps further than you. Legislation won't fix it. Until the military is authorized to start up a new branch of the military to redteam corporations, nothing will ever change. If they don't patch immediately, throw the entire C-suite in Gitmo under suspicion of being enemy combatants.

Does that sound hyperbolic? It really shouldn't. These negligent corporate parasites are by far the greatest national security threat we've ever faced. bin Laden couldn't have dreamed of doing as much damage to the US as they have. China will hand us our asses on a silver platter if we ever go to war with them, because these rootless global capitalists have betrayed their country with every budget they've approved with 100x more given to stock buybacks than infosec. Taiwan better start reading Mao's little red book, because we don't stand a chance.

Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It's just going to make it so no qualified person will ever take the CISO fall-guy position, only exacerbating the problem further. It's not the CISO's fault.

> Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything.

It might? In civil engineering it kind of works like this, doesn't it?

I don't believe professional engineers are held liable for a legacy bridge that they can't get funding to repair, or a project that was built in violation of their specifications by a corrupt contractor. They're only held liable when the engineering work is flawed.

It doesn't actually. It just means construction becomes extremely slow and backwards because engineering subcontracting firms now send unlimited amounts of construction delay notices to cover their asses when things are wrong and then ultimately still building the wrong and outdated things and leaving it up to the auditors later to fail the audit review to allow people into the building.

So if your goal is to not have people die, you accomplished your mission, but if your goal was to make the project owner be responsible not to fuck up you still failed.

What you've described is essentially China, so no I can't agree with you. I can't imagine ever wanting to live in that world, but if you do it's never been cheaper to fly across the world.

The only similarity is that China holds corporate executives accountable. The idea isn't to backdoor every company like the CCP or the NSA and leave them sitting ducks, it's to make them close the backdoors.

The country I'd point to for inspiration on this is actually Israel, a country even less deserving of praise than China in my opinion, but hey, good ideas can come from bad places. There's tight integration between the Israeli private cybersecurity sector and the Israeli military. Israel had a very prosperous tech industry, at least until the present constitutional crisis. The IDF trains cyber soldiers for four years, then the private sector hires them.

You can't solve the cyber warfare problem without the military. Capitalism is structurally incapable of doing it alone, any more than Detroit's manufacturing plants could've defeated Japan without the military nationalizing them. Cyber policies and products without the military's direct involvement is like guns without bullets.

Whis is why laws like the GDPR exist. That doesn't mean you need to allow domestic intelligence agencies to rife through victims' pockets and see what they can find.

I don't know what you think you're referring to. The police are absolutely empowered to break down your door and stop a crime if they have cause to think one is happening. That ship sailed long ago, and generally agreed for the better.

If you read, God forbid, what's happening it is not materially different than the fbi saying "hey there's a domestic, let's go and break it up." Even if the door is locked they're allowed in.

I concur!

How would they identify the person and get their contact info. I'm assuming their automated system is looking at IPs and services

Useful occasionally, without doubt.. but the abuse potential, blown proportionality, and then these legislations always only know one way. Its never about that this wouldn't be useful to the utopian goods vs the criminals. :/

That example seems a little contrived, when with the legislation used for interception is broad enough to just got after the actual target straight away. Seems a long way for a shortcut, so to speak.

The fear in this regard is more about overreach and stalking by officers twisting the law for their own agenda. Dunno whenever that's a widespread issue with the Dutch police.

As an example: It's doubtful they could get a warrent for their neighbors girlfriend, but now they've got another legal way in.

It remains to be seen wherever that's actually going to happen though.

They are good about transparency, but abuses do happen when they think no one is looking. Unfortunately for us.

> Dunno whenever that's a widespread issue with the Dutch police.

Every police force has issue with abuse of power and the Dutch are no different. As always, it is the worst in the margins and so hard to get a picture of how bad it is in an empirical way.

I don't believe it's wide spread but exactly that is possible with the Dutch government and without any consequences.

I lived next door to one of their targets from a drug investigation. The other neighbor was involved and for the next 10 years the other neighbor was allowed to commit all manner of criminal offenses against me and stalk me and the government protected him. They protected him all the way to the courts and then the prosecutor lied in court. I filed criminal charges with the police against him for obstruction of justice. A year later it was dismissed, I filed an appeal to the attorney general and it was dismissed again. The evidence I had against him was overwhelming they simply will not prosecuted a prosecutor in the Netherlands or obstruction of justice.

The laws for using civilians in investigations here forbid the use without having a contract upfront, the civilian is not allowed to commit any crimes. However, none of that matters cause there's no effective control and absolutely no consequences. The laws and their guidelines are just bullshit for the public to read and think that it's all under control.

The Dutch government were envious of what organized crime could do and now the government is organized crime. And yes, completely innocent, non crime involved citizens can become victims of this.

Oh no, this worm is targeting literally our entire population! I guess we have carte blanche now...

How is that easier for law enforcement than just hacking the targets anyways? It's way more steps that can go wrong and way more people who could blab about your operation.

So, if you've been victimized once by a criminal, you can be victimized again by the government?

Sounds like a great disincentive to reporting being hacked to authorities.

Exactly, this is giving serious power to the government over peoples privacy.

Reply on news.ycombinator.com