How about asking the hacked person for permission to access their (other?) communications to prosecute the hacker? Too simple? Doesn't scale automatically? But if the latter is the case, it's not something to be used sparingly.
I was wondering how this would fit if an entity like equifax wanted to hide a data breach. However, reading your statement again, failure to report a security breach is unlawful in all fifty states as far as I can tell from a Google search (I anal, I don't know the law) so I'd imagine EU laws would be at least as strong as this.
With that out of the way, yes, I am ok with this.
Those are not really a thing in the EU (at least, not for regular police)
> you're not free if the government can just seize your things when you have not broken any law
This is something that can and does happen in the Netherlands, f.e. when the government feels they need to destroy your apartment and build a new one (as part of gentrification, generally). They are tangentially required to get you replacement housing, but not at the same price or in a similar location. Thus, not in any practical sense. If they cannot find this for you they will still kick you out and where you will live after is your problem.
The Netherlands is party to the ECHR. Article 5 through 8 inclusive are relevant, especially Article 8.
The Dutch constitution may also cover this ground, but I'm not familiar with it.
Though reading Article 8 -- Right to respect for private and family life -- I'm not sure if this matters IANAL
> 2. There shall be no interference by a public authority with the exercise of this right __except such as is in accordance with the law__ and is necessary in a democratic society __in the interests of national security, public safety__ or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others
That feels like as long as it is the law then it doesn't violate Article 8. Seems that saying it is for public safety is also another way to get around this. I also noticed this in Article 11 (right to assembly) and some others. Not being a lawyer, these seem pretty non-binding.
The good news is that “necessary in a democratic society” is a high bar. Thankfully there have been several successful challenges to government mass surveillance in the past, under this Article.
Unfortunately, proposals like this keep coming back, and you never know what way a court will rule.
This obviously cannot be a boundary condition for policing; it's adversarial. The question is whether this balances public needs against private rights. My gut feeling is the extensions should require court approval or disclosure.
The infosec goobers on HN are about 5 years behind the times. Since about Obama (when the fbi started doing this in the us) it's been clear that the whole name/shame won't cause orgs to do better. Publishing active proof of concepts for exploits will not cause orgs to patch. It will take national legislation giving people federal-pound-me-in-ass-prison to get them to enforce cybersecurity.
Does that sound hyperbolic? It really shouldn't. These negligent corporate parasites are by far the greatest national security threat we've ever faced. bin Laden couldn't have dreamed of doing as much damage to the US as they have. China will hand us our asses on a silver platter if we ever go to war with them, because these rootless global capitalists have betrayed their country with every budget they've approved with 100x more given to stock buybacks than infosec. Taiwan better start reading Mao's little red book, because we don't stand a chance.
Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It's just going to make it so no qualified person will ever take the CISO fall-guy position, only exacerbating the problem further. It's not the CISO's fault.
It might? In civil engineering it kind of works like this, doesn't it?
So if your goal is to not have people die, you accomplished your mission, but if your goal was to make the project owner be responsible not to fuck up you still failed.
The country I'd point to for inspiration on this is actually Israel, a country even less deserving of praise than China in my opinion, but hey, good ideas can come from bad places. There's tight integration between the Israeli private cybersecurity sector and the Israeli military. Israel had a very prosperous tech industry, at least until the present constitutional crisis. The IDF trains cyber soldiers for four years, then the private sector hires them.
You can't solve the cyber warfare problem without the military. Capitalism is structurally incapable of doing it alone, any more than Detroit's manufacturing plants could've defeated Japan without the military nationalizing them. Cyber policies and products without the military's direct involvement is like guns without bullets.
If you read, God forbid, what's happening it is not materially different than the fbi saying "hey there's a domestic, let's go and break it up." Even if the door is locked they're allowed in.