German police name alleged leaders of GandCrab and REvil ransomware groups
krebsonsecurity.com
krebsonsecurity.com
Makes you wonder if the investigators discovered this independently, or decided to maybe ask the hackers already involved in defending against them for help...
1: https://de.wikipedia.org/wiki/Vorbereiten_des_Aussp%C3%A4hen... [de]
I'm not sure white-hat hacking is broadly compatible with German culture. Keep in mind that going bankrupt in Germany permanently closes off lots of avenues, from future lending to whether you can be in senior management at a public company.
They really couldn't. BVerfG (Germany's constitutional court) has clearly said that dual use tools have a presumption of not being tools to break the law. It's been very clear that mens rea matters. And that a narrow reading of the law is the only constitutional reading.
The problem here is taking "word for word" as "by dictionary meaning", which is never how laws are read.
It's still a problematic law (together with §202a/b) because it doesn't clearly carve out space for grey-hat activities (white-hat attacks with authorization really don't fall under it even with creative reading).
On the upside, Germany is considering fixing that. On the downside, it moves with the speed of classic German bureaucracy and is being "discussed" since 2024.
Back in the days of "smart contracts" and "DAOS" this was something many well-meaning technical people struggeled with. Humans and their societies are flexible and therefore laws must be flexible as well (to a certain degree before it becomes damaging).
It's also why a lawyer/expert is usually recommended when engaged with legal matters: We as layman lack all the context around seemingly "simple" concepts, procedures and definitions. You can learn all of that or hire a professional.
In that way, I don't really think the government need to design laws to have loop holes in them. With enough political pressure they can get the judges to make any decision they like.
nor should there be.
Similar to how us American hackers have a huge dislike and distrust of the FBI.
Your own law enforcement agency will lie to you, manipulate you, raid you, extort you, and imprison you over bullshit.
But this is not, how it should be. And not all law enforcement agencies are like this.
Fun fact: In the 1990s, the CCC e.V. was declared a terrorist organization by the BND. Also, a lot of members have been sued for Landesverrat (high treason) for disclosing found vulnerabilities and/or doing journalistic work.
For example, the netzpolitik guys have been sued for high treason twice.
Just as a side note on how competent the German state is to use their existing talent to work on issues in cyber security.
> If a hacker collaborates with the BND they do run a risk of many of their peers not wanting to collaborate with them anymore.
Another fun fact: There is no effective witness protection program in Germany. You have to have been attacked almost murdered twice (with legal cases leading to prosecution) before you can apply for the witness protection program.
And they're asking themselves why all the witnesses in high profile cases from Europol/Interpol keep disappearing ...
80th, 90th were the last time were hacking was a means to an end. C64 and Amiga scene had skindheads showing up at copy parties but no one cared really.
Some were a bit unsure but the moment they talked about their craft there was no divide but hacker spirit.
In recent years this would be unimaginable. And guess what? Talking to each other made the skins disappear.
It was more of a niche expression without doing harm. Popper, Goths, Ted’s, Rockers - in comparison to today there was more unity than today.
Hooligans were the same. Many local groups that fought each other due to political stances befriended each other later because it was more of a ritual than ideology.
It is a bit sad because politics doesn’t belong to hacking, and never did.
Hacking is Boolean only in the sense of it either works or it doesn’t. Or does a computer care about left or right?
And BtW that’s why I find local attempts in Europe for “Go EU” pathetic. It is about ideology, not improvement.
Apparently they had not been contacted.
[Edit] "An international search is underway for Daniil Maksimovich SHCHUKIN on suspicion of numerous counts of gang-related and commercial extortion using ransomware to the detriment of commercial enterprises, public facilities, and institutions."
The dilution of the word doxxing has been interesting, though. Some of the recent "doxxing" controversies have been about figures who weren't all that anonymous to begin with. The pop culture meaning has been extended to cover any mention of someone's real identity at all, even if it wasn't a secret.
I’ve been seeing it come up in discussions about court cases where people are under the belief that requiring online personalities real names in the court documents is somehow illegal because it’s doxxing.
Most of us grew up on the Internet, and consequently our world view is incredibly screwed and not particularly based on facts
The Internet is real life, that's why the judicial documents will cite the real names of the people, wherever they want to or not.
There aren't different sets of rules, the real lifea rules apply everywhere. You may just also have additional conventions some people may follow online, too. Entirely optional and liable to go out the window as soon as there is a conflict
Its almost always associated with a private person (ie not police or anyone of a judicial system) releasing personal information with malicious intent.
As the person above you said, semantics are important. This is a judicial system specifically searching for a person they believe to have caused severe criminal harm.
As you said, in this particular case, the respective judicial entities purposefully released the personal information with the intent of arresting both. Whether that is successful or not remains to be seen but that's a different story.
For me personally, I understand doxing to be the release of personal information with malicious, indirect intent. For example, hoping that an angry mob will find the home of a person and attack them, send the person death threats through the post, etc.
Assuming a decently functional justice system, I don't consider an arrest warrant a malicious intent.
"Doxxing" certainly doesn't carry a negative connotation in that usage. Unless you live in a culture where torturing domesticated animals is a good thing.
ANd I recall that, before that, hackers would doxx other hackers in the 90s in order to get them arrested. Again, that seems like the exact same usage as here: tying a pseudonym to an IRL for purposes of law enforcement.
If it's negative depends on if you think they deserve the hostility.
In my experience, plenty people use "doxxing" to refer to their own actions positively. There are even calls to action: "let's doxx him"
See the canonical example of this going wrong: the Reddit 'investigation' of the Boston Bomber, where someone was misidentified, doxxed, and their family was harassed.
Of course, law enforcement is capable of making the same mistakes. But ideally they have better safeguards, and victims of their negligence have much better recourse.
I disagree. Tying a pseudonym to an IRL persona for purposes of law enforcement is a part of an official investigation.
Doxxing is specifically non-government unmasking and dissemination of that tie for extrajudicial purposes, almost always for harassment. There is a world of difference between them and we should not fudge them together with terminology. My 2c.
https://en.wikipedia.org/wiki/Extrajudicial_killing#United_S...
'Extrajudicial killing' is just an apologetic euphemism. An indirect term, since murder is usually considered to be a bad thing.
Someone who breaks the law and is actively searched for obviously has no expectation of privacy, or do you think the people visiting Epstein's island were doxxed?
Yesterday I drank a beer out in public - a perfectly legal and culturally/morally acceptable thing to do here in The Netherlands, but deemed wrong to such a degree that it is apparently punishable by death in Iran[1].
I have actively broken Iran's moral stance, societal norms, and laws/jurisprudence against public alcohol consumption from without their jurisdiction, and as being a person unbeholden to their societal norms in any way, shape, or form.
Do I obviously now have no expectation of privacy? Is it now okay for these peoples finding themselves to grievously offended by my actions to collect and publish my private data with damaging intent? Is it then doxxing? Am I really a bad person now? Or maybe it depends on the color of your glasses, maybe there exists an entire world outside of ones own cocoon?
[1]: https://www.hrw.org/news/2012/06/29/iran-quash-death-sentenc...
I'd rather "doxxing" just mean "de-anonymizing" because that's 1) how I already read it, 2) removes the whole "who is the more moral side in this dispute therefore has the right to make the accusation" problem
No, if they just put UNKN on the most wanted list, then it wouldn't be doxing. But then they also tie UNKN together with "Daniil Maksimovich Shchukin", and that's the doxxing, regardless or not if it's on a most wanted list.
Perhaps this goes back to leftist terrorism in Germany in the 1970s, they would not use the code names of terrorists on the wanted lists but their real names to find them, because this is what they wanted - but I don't know.
I misread that as it either would be the thing to do or an alternative option and you were against putting names on a wanted list.
This seems to be just issuing an arrest warrant.
Unless there's something not covered in the article, his current address, family members, phone, etc were not listed. That's not doxxing; that's "here's a guy were want to arrest."
BTW, what do you think will happen when people find out that their neighbor is secretly a pretty wealthy criminal? Attempts of theft, robbery and extortion have happened in the wake of such announcements.
There was even a case where somebody attempted to impersonate an intelligence officer and try to force a recently doxxed cyber criminal to bribe them.
Who knows, but I'm also not sure how you avoid that situation. Presumably, to be "doxxed" like this, there's substantive evidence he is actually the criminal. Strikes me as just one more downside of being a successful (but now identified) extortionist.
Call the police? Isn't this the point?
Some take a "full disclosure" style and expose all OPSEC failures instantly and transparently, because otherwise people seem to collect OPSEC failures and make it seem to be extortion itself, like saying "hey remember that time you signed off with your real name?" or "I know your clearnet address"
Also talk about a headline that would mean absolute gibberish just a couple decades ago.
Of course, whether or not to use a VPN always depends on the specifics. (threat model, circumstances, VPN provider, etc.)
I am with the biggest telecoms provider in Germany, and I trust them about as far as I can throw them.
They are known for censoring their DNS servers, being opaque about government requests, and creating artificial bottlenecks to extort money from companies in order to avoid throttling.
E.g. in germany it was a real crime to grow some weed. Now it's legal, but even before a lot of reasonable people didn't want someone go to jail over weed.
What I notice as different, and I'll try to keep this as minimally political as possible but, as you say, it seems to be an increasing irrational tendency to throw the baby out with the bathwater. De-fund the police as an example. I think the positives outweigh the negatives in this example, by a fair margin, but people react to what they're exposed to and the focus on outrage-bait-for-engagement in the current media environment has this an an outcome.
Additionally, the decreasing respect for the rule of law by the leaders of countries only leads their populace into the same kind of thinking. Leading a country backwards from the civilisation that is borne from the application of rules around behaviour and into the chaos that preceded said civilisation (this is a long term process and can be turned around, I'm not saying to start panicking just yet).
Some grey area is OK, and is almost necessary, for the sake of the ability to have the conversation about moving the law to be more in line with societal expectations, but too much grey area leads back to societal breakdown and chaos.
If growing weed is illegal in Germany, and someone unknown grew a lot of weed in Germany, they end up being sought, and (eventually) their name and other details could end up in a police warrant.
The comparison is moot though since growing weed in Germany requires physical presence in Germany. The alleged cybercrimes could've originated from anywhere in the world due to the nature of the internet.
It just isn't doxing unless you don't see legal merit in the German police and German authorities. Which is obviously rhetoric the Russians want others to follow.
Identifying a criminal is ethical.
This outsourcing of one's morals to the state is excessive even by already high western white collar internet standards.
Now, make no mistake, these guys are up to no good and probably should be identified and prosecuted, but to just declare that a bad thing is now good because government is doing it is basically an abdication of one's moral compass. At best this is still a bad thing but a necessary one because all the other options are worse. Like shooting someone in self defense, or putting someone in a cage for doing sufficiently bad things.
Edit: I'll admit I played too loose with ethics vs morality here, but still the point stands.
anyway individuals willingly give to teh state some autonomy in return for the safety of governance... that's the social contract free people have with government
"doxxing" a Russian ransomware group is the kind thing to do. bombing them out of existence is within the remit of the range of ideas a government could resort to...
>law
>legally
You keep using these words but it causes circular logic as those are all defined by the same entity that is acting unilaterally.
The action the government took was not a "good" action by any moral standard. But it was perhaps the least worse action available all things considered. Can't just whisk people off the street in a foreign country or drone them over such matters, those options would be worse.
It's on like place 10 out of 180, which makes it one of the least corrupt places.
It also has some surprisingly non-boomer departments, like the Sovereign Tech Fund. Either way you need to celebrate police doing good things and immoral actors being exposed, it can only have good outcomes.
Perhaps it deters them, or deters the next generation of such hackers. Or at least it makes their life less enjoyable, which is fair since they were only able to afford their travels due to their illicitly acquired wealth.
The one that has just invested in Scala? In year 2026? There are many good things about Germany, but competence in tech is not one of them.
[1] https://en.wikipedia.org/wiki/Parable_of_the_broken_window
It's not, in Germany we have separation of powers.
> The action the government took was not a "good" action by any moral standard.
Morals aren't binary. Morals have context.
It historically was used for this exact case: revealing someone hiding behind a pseudonym for purposes of law enforcement. The term dates back to the 90s, if not earlier.
This isn't something Gen Z made up. It's a Gen X term. "Hack the gibson" era. Wargames era.
I might want to do violence upon you for some reason. Maybe I hate you. Maybe you're doing something that I don't like. If I'm lucky I can round up half a dozen buddies to help. But I don't have infinite resources and infinite reach, so my capability is rather laughable unless you live next door.
Buuuut, if I craft it just right, I can cause the state with it's practically infinite resources, infinite men with guns who kick in doors, etc, etc to choose to kick in your door and do violence upon you. (And the request usually looks a lot like doing their job for them "hey look over here there's this specific person doing this specific thing that you're supposed to go after", but that's beside the point.)
Same as how if I craft a request to a 3rd party server just right a few Kb of on my end can become dozens of Mb on yours.
The German police can't reach these guys. Hence why they're doxing them. They're hoping to structure things such that those who can reach them respond to the request (i.e. rounding up these guys will be a line item in some larger geopolitical context).
Then it follows, given your description of the motivation of German police, that they are trying to induce "real violence" upon the people, and therefore the German police doxxed them.
I agree that “doxxing” is being misused in TFA, but criminals have privacy rights like anyone else. Violating these rights requires specific justification, it’s not automatically ethical.
Is it ethical to dox a pregnant woman seeking an abortion in a southern US state?
Is it ethical to dox a gay human rights defender in Russia?
Is it ethical to dox a woman seeking an education in Afghanistan?
Not all criminals have done something wrong.