Hacker News Reader

Comment by tlrobinson | Hacker News Reader

In June 2012, the FBI arrested Michael "xVisceral" Hogue at his home in Tucson, Arizona and charged him with selling "malware that allows cybercriminals to take over and control, remotely, the operations of an infected computer."

First of all, I don't condone this behavior, and using such software for "ratting" should obviously be illegal, but is it really illegal to sell this type of software (or any malware)?

It seems incredibly dangerous to make software illegal based on it's potential illegal uses.

I recall a controversy about a "hacking tools" law in Germany a few years ago, but never in the US. What law would this fall under, if any?

View on HN

If you sell software with features that could only reasonably used for illegal activitities, such as sending you the creditcard number someone is entering, then: a resounding YES! Also if you advertise features for illegal use, even if they could be used for legal things.

I recollect that the German law was written in a way that would logically classify gcc as a hacking tool, i.e. the definition was very broad.

I'd be interested in the definition/ law being used here.

That's beside the point. There are plenty of valid uses for other things which would have been criminalized such as Metasploit and Core Impact. Not to mention that such things as writing PoC code to validate vulnerabilities would have been right out of the question.

I accept what your point which I take to be that a law or regulation that attempted a narrow definition of tools thought to be for criminal purposes would still criminalise legitimate activities. It is the activity that should be against the law, not possession of the software.

I was just wondering what the law used in this case was.

Yes, but privacy.

A lot of activities are incredibly hard to actually catch someone in the act of, and incredibly hard to actually get hard proof of. Possession, on the other hand, is a strong correlation and proof of itself. The reasonableness of this correlation is what draws the line between whether or not possession is illegal, and that's going to be subjective.

It's really easy to forget that the first and foremost reason we defend privacy isn't because its breach is icky. It's because illegality is sometimes the right thing to do. However, usually it's not. This is a natural contradiction that makes writing law difficult.

Absolutely agreed--this is a point I made in other posts. I apologize if I came across as harsh--absolutely not my intention.

Out of curiosity, what law makes it illegal?

I'd be curious to find out as well. It's a very fine line between a luhn10 checker, and a luhn10 sniffer--the law's wording would need to be very precise to avoid criminalizing legitimate business software.

Plus pen testers could argue that they legitimately need any tool a hacker could possibly use in order to test the security of their systems.

nmap was one example I remember hearing would be considered illegal under Germany's new law.

s/could/do/

This is the problem with these manner of laws. Criminalizing the very method by which entities guarantee their security is never a good idea.

It's not that hard to carve out exceptions. Professionals can buy really dangerous fireworks that are 'illegal'.

Most likely this will lead to official certification and registration of pen testers like locksmiths and alarm system installers are required to have in some states..

Yeah, this is pretty likely. It's a dangerous road to go down, however, as regulatory bodies can be far from impartial.

It's a difficult issue to properly address. I think the right method to go about it is to punish actions, rather than possession of tools. On some level, simply having the ability to write software makes one suspect, if you start scrutinizing tools. Actions (compromising boxes and running exploits without permission of the owner of the host, advertising explicitly criminal use of software) are easy enough to define, and it's easier to define an exclusive list of "bad" actions, than to come up with generalizable rules.

Often I think authorities realize these laws are over-broad but don't care. They just selectively enforce.

For example in NZ, the crimes amendment act 2003 allows for prosecution[1] of anyone who drops or sells 0day.[2]

It's one of those laws which has never been enforced, but probably would be if you made a nuisance of yourself.

---

http://www.legislation.govt.nz/act/public/2003/0039/latest/D...

(Section 251 Making, selling, or distributing or possessing software for committing crime)

[1] "liable to imprisonment for a term not exceeding 2 years"

[2] The requirement is "the sole or principal use of which he or she knows to be the commission of a crime". However, gaining unauthorised or unlawful access to a computer system is a crime meaning exploits qualify.

This sounds mostly reasonable at first glance. I'd have to dig a lot more into how it's played out in practice to have a fully-valid opinion, of course.

The one thing you mention that worries me, though, is dropping 0day. Would this include full disclosure? Would this include developing an 0day as part of a pentest? How does this affect things even as far reaching as responsible/coordinated disclosure? If a law makes doing the right (let's use open disclosure, whether full and immediate or coordinated and timed just to mean "right" while selling 0days for ostensibly criminal purposes as "wrong" for the sake of this conversation) thing as difficult (or even more difficult) to do than the wrong thing, then the law will only bolster the black market.

These are open questions which have never been resolved since section 251 was introduced in 2003. Note that this is NZ law only and I am not sure of the situation internationally.

Some relevant quotes: -----

http://www.giac.org/paper/gsec/4001/zealand-information-tech...

"Although most cases of legitimate have been covered, not all have. Section 251 does potentially raise some interesting issues around concepts that many security professionals are supportive of, the sharing of information and full disclosure..."

http://www.bellgully.co.nz/newsletters/03CTM/03CTM_HackersBe...

"On the face of it, such criticisms may be justified. Whether or not the Amendment Act will actually have this effect will only become clear through the passage of time. In this regard, “good” users of such information may have to rely (tentatively) on the police's discretion whether or not to prosecute a particular case."

I am not a lawyer, but I have noticed convictions. The grounds where simply 'aiding and abetting' criminal activities.

Remote desktops can be used for all sorts of things, among others helping people with their computer problems.

And the sellers of THOSE remote desktops don't have a problem.

In this case the specific software we're talking about had a feature whose specific purpose was to detect someone entering a credit card number, screenshot it and upload the image to an FTP server:

'In further MSN chats with the FBI, the person alleged to be Hogue answered a question about whether the Blackshades software would automatically conduct key logging or whether it had to be initiated manually. "It auto does, and you can download from all at once, or scan for keywords or digits," came the reply. "And if it detects a credit card is being entered, it can send screenshots to FTP and you can scan for digits that are 16 in a row :P"'

It also had as a feature to encrypt a users files and pop up a ransom notice:

'Blackshades went beyond DarkComet in its support for features that were likely to result in illegality, such as the "File Hijacker" that could encrypt a victim's key files and then pop up a "ransomware" message demanding payment into a remote bank account in order to free the files. (A note attached to this feature said: "However, one thing to put in mind: This feature was made for educational purposes only.")'

In general, even tools that are quite clearly intended for illegal uses seems to be ok. But this one took it much further.

I think it depends on the generality of the software. Obviously a general purpose remote desktop program has a lot of more legitimate uses that something designed specifically to find CC numbers.

Thing is , you could make a CC sniffing program and then realise "hmm, this might be difficult to defend in court" so you generalise it to something that simply looks for arbitrary strings of numbers. Of course the fact that 90% of your users happen to enter "16" into the box is not your fault.

The generalised program might have useful side effects as a result, but it is no less dangerous than the more specific program.

OK didn't read the article very closely, sorry.

so you would be ok with people being arrested for selling software to rip dvds or cds?

ACME kitchen knives: great for chopping onions and murder sprees.

Yes that is tongue-in-cheek but there is an equivalence here in that the consumer decides how the product will be used. I do agree that advertising use for illegal activity should be quashed (does that impinge on free-speech?).

> does that impinge on free-speech?

It could be argued that free speech necessarily has limitations. Depending on where you are in the world, this involves hate speech and incitation to violence.

I would readily agree that distributing (especially SELLING) tools with the expressly stated purpose of criminal use should be punishable. That being said, the same tools are likely useful for legitimate purposes. Heck, I could see an argument for Back Orifice being useful in that one would really like to be assured that their network's egress filtering would raise flags when BO traffic is on the wire. This brings up another important point--these tools are always useful for people who are writing protection and mitigation against the tools' methods.

Selling kitchen knives: not illegal.

Selling kitchen knives, and giving tips and instruction on where to stab to inflict maximum damage: I'd be very surprised if you're not legally liable for the actions of the third party. But, IANAL.

EDIT: as for free speech, the "imminent lawless action" [1] test is AFAIK the current standard in the US. I'm sure there's case law around this that I'm not familiar with, but I'd argue giving killing tips is likely to incite "imminent lawless action" in the knife analogy.

1. http://en.wikipedia.org/wiki/Imminent_lawless_action

Have you heard of someone being arrested and charged with possession of drug paraphernalia?

Drug paraphernalia could be coffee filters, aluminum foil, a pipe, roach clips. These are all things that are totally legal to purchase yet you can be charged with a crime for having them. To avoid it, you have to avoid being suspected of drug use or being added to the local 'most wanted' list.

In Sweden, running a service is deemed illegal if the majority usage is of an illegal nature. The appeal court explicitly wrote this in their decision regarding the pirate bay case, in answer to a question regarding search engines like Google. For evidence, they refereed to the screen shots of top 100 charts made by the - since employed by MPAA - investigator.

I always wondered what that would mean to an email service, since the primary form of email can easily be illegal spam/scams. I would also be careful if I ever contributed to projects like nmap, because how can I prove what the primary usage of such program is? Could it be defined that I was performing a service if I contributed code?

There is so much wrong with your comment.

1) It is not the software that is illegal, it is the selling of it as your quote clearly shows.

2) If the software has no other purpose than to commit crimes, then yes, the selling of that software should be illegal. It is selling a tool whose sole purpose is to facilitate criminal activity.

I don't trust the courts to determine which software "has no other purpose than to commit crimes". As I point out in another comment, penetration testers could argue that they'd legitimately need to use nearly any software used by hackers, including stuff like Metasploit. Someone else also points out it could potentially inhibit people disclosing vulnerabilities.

Courts tend to focus on intent.

Further reading: [What Colour are your bits?](http://ansuz.sooke.bc.ca)/entry/23

Reply on news.ycombinator.com