I'd be interested in the definition/ law being used here.
I was just wondering what the law used in this case was.
A lot of activities are incredibly hard to actually catch someone in the act of, and incredibly hard to actually get hard proof of. Possession, on the other hand, is a strong correlation and proof of itself. The reasonableness of this correlation is what draws the line between whether or not possession is illegal, and that's going to be subjective.
It's really easy to forget that the first and foremost reason we defend privacy isn't because its breach is icky. It's because illegality is sometimes the right thing to do. However, usually it's not. This is a natural contradiction that makes writing law difficult.
Yes that is tongue-in-cheek but there is an equivalence here in that the consumer decides how the product will be used. I do agree that advertising use for illegal activity should be quashed (does that impinge on free-speech?).
It could be argued that free speech necessarily has limitations. Depending on where you are in the world, this involves hate speech and incitation to violence.
I would readily agree that distributing (especially SELLING) tools with the expressly stated purpose of criminal use should be punishable. That being said, the same tools are likely useful for legitimate purposes. Heck, I could see an argument for Back Orifice being useful in that one would really like to be assured that their network's egress filtering would raise flags when BO traffic is on the wire. This brings up another important point--these tools are always useful for people who are writing protection and mitigation against the tools' methods.
Selling kitchen knives, and giving tips and instruction on where to stab to inflict maximum damage: I'd be very surprised if you're not legally liable for the actions of the third party. But, IANAL.
EDIT: as for free speech, the "imminent lawless action" [1] test is AFAIK the current standard in the US. I'm sure there's case law around this that I'm not familiar with, but I'd argue giving killing tips is likely to incite "imminent lawless action" in the knife analogy.
'In further MSN chats with the FBI, the person alleged to be Hogue answered a question about whether the Blackshades software would automatically conduct key logging or whether it had to be initiated manually. "It auto does, and you can download from all at once, or scan for keywords or digits," came the reply. "And if it detects a credit card is being entered, it can send screenshots to FTP and you can scan for digits that are 16 in a row :P"'
It also had as a feature to encrypt a users files and pop up a ransom notice:
'Blackshades went beyond DarkComet in its support for features that were likely to result in illegality, such as the "File Hijacker" that could encrypt a victim's key files and then pop up a "ransomware" message demanding payment into a remote bank account in order to free the files. (A note attached to this feature said: "However, one thing to put in mind: This feature was made for educational purposes only.")'
In general, even tools that are quite clearly intended for illegal uses seems to be ok. But this one took it much further.
Thing is , you could make a CC sniffing program and then realise "hmm, this might be difficult to defend in court" so you generalise it to something that simply looks for arbitrary strings of numbers. Of course the fact that 90% of your users happen to enter "16" into the box is not your fault.
The generalised program might have useful side effects as a result, but it is no less dangerous than the more specific program.
For example in NZ, the crimes amendment act 2003 allows for prosecution[1] of anyone who drops or sells 0day.[2]
It's one of those laws which has never been enforced, but probably would be if you made a nuisance of yourself.
---
http://www.legislation.govt.nz/act/public/2003/0039/latest/D...
(Section 251 Making, selling, or distributing or possessing software for committing crime)
[1] "liable to imprisonment for a term not exceeding 2 years"
[2] The requirement is "the sole or principal use of which he or she knows to be the commission of a crime". However, gaining unauthorised or unlawful access to a computer system is a crime meaning exploits qualify.
The one thing you mention that worries me, though, is dropping 0day. Would this include full disclosure? Would this include developing an 0day as part of a pentest? How does this affect things even as far reaching as responsible/coordinated disclosure? If a law makes doing the right (let's use open disclosure, whether full and immediate or coordinated and timed just to mean "right" while selling 0days for ostensibly criminal purposes as "wrong" for the sake of this conversation) thing as difficult (or even more difficult) to do than the wrong thing, then the law will only bolster the black market.
Some relevant quotes: -----
http://www.giac.org/paper/gsec/4001/zealand-information-tech...
"Although most cases of legitimate have been covered, not all have. Section 251 does potentially raise some interesting issues around concepts that many security professionals are supportive of, the sharing of information and full disclosure..."
http://www.bellgully.co.nz/newsletters/03CTM/03CTM_HackersBe...
"On the face of it, such criticisms may be justified. Whether or not the Amendment Act will actually have this effect will only become clear through the passage of time. In this regard, “good” users of such information may have to rely (tentatively) on the police's discretion whether or not to prosecute a particular case."
nmap was one example I remember hearing would be considered illegal under Germany's new law.
This is the problem with these manner of laws. Criminalizing the very method by which entities guarantee their security is never a good idea.
It's a difficult issue to properly address. I think the right method to go about it is to punish actions, rather than possession of tools. On some level, simply having the ability to write software makes one suspect, if you start scrutinizing tools. Actions (compromising boxes and running exploits without permission of the owner of the host, advertising explicitly criminal use of software) are easy enough to define, and it's easier to define an exclusive list of "bad" actions, than to come up with generalizable rules.