RE: Cybercrime treaty

["Prosser, Mike" <mprosser@symantec.com>]

I think "intent" plays a large part in the draft version here (Jim, glad you
brought up the gun thingy....that was my first thought as well...just didn't
want to be considered the redneck, gun-happy member of the board {8>)).  The
intentional "vagueness" of this Charter is what worries me.  I realize it is
to allow additional areas to be covered under the Articles without modifying
the Charter, but it also leaves many areas open to interpretation.  Case in
point -Article 6 second a (that Matt mentioned) "the possession of an item
referred to in paragraphs (a)(1) and (2) above, with intent that it be used
for the purpose of committing the offenses established in Articles 2 - 5".
In the hands of some this is an offense..in the hands of others this is a
normal part of the job.  But this is also why when service teams are out on
assignment, you ensure you have authorized approval prior to beginning the
assessment.
The charter goes on about what is illegal, but doesn't cover what would be
consided "legal" usages of such "tools" and I think that seems to be a
sticking point.

---Mike


-----Original Message-----
From: Magdych, Jim [mailto:Jim_Magdych@NAI.COM]
Sent: Wednesday, May 03, 2000 5:44 PM
To: 'David LeBlanc'; 'Steven M. Christey';
cve-editorial-board-list@lists.mitre.org
Subject: RE: Cybercrime treaty


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Isn't there legal precedent defending source code as free speech -
and hence protected by the first amendment?  This sounds like a
no-brainer to me...  Of course, some of the people drafting this sort
of legislation do, on occasion, come across as being brainless.

There needs to be a clear distinction between the distribution of
demonstration code and the distribution or use (with malicious
intent) of exploits.  Because that is a VERY gray area, it might be
better to decide such things on a case-by-case basis.  I liked the
locksmith/burglar analogy (but what of the convicted burglar who
decides to become a locksmith?).  A more accurate analogy, though,
might be a gun.  I can own a gun.  I can even shoot it under certain
conditions.  As soon as I shoot it AT someone else, though, it's a
crime.

- - Jim

> -----Original Message-----
> From: David LeBlanc [mailto:dleblanc@MICROSOFT.COM]
> Sent: Wednesday, May 03, 2000 2:34 PM
> To: 'Steven M. Christey'; cve-editorial-board-list@lists.mitre.org
> Subject: RE: Cybercrime treaty
>
>
> Given prior precedent in many other areas, I don't expect
> that something
> like this would be constitutional in the US - for example, it
> is quite OK
> for me to buy Anarchist's cookbook, and have the recipe to
> make bombs or
> drugs, but quite illegal for me to actually make these items.
>
> This of course only loosely applies to code, since it could
> be that having
> the code isn't illegal, but having the binaries are illegal.
>
> IMHO, even though I really detest seeing code whose main
> purpose in life is
> to enable script kiddies to commit felonies, the safest thing
> to do all
> around is to not worry about the programs, but how people use
> them - e.g.,
> having a crowbar isn't bad, but smashing your door in with it is
> bad.
>
> The whole thing is a real mess - one can expect civil
> liberties to come
> under pressure when people start getting worried.
>

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1
Comment: Crypto Provided by Network Associates <http://www.nai.com>

iQA/AwUBORCsyQDjeqNVcQB5EQKPeACfTkyfxCY7vT2f6IdqN8BjW6lRNvsAoJdO
ps3fFxRbKlr3NDz9gjvbOF7o
=jvzh
-----END PGP SIGNATURE-----