Felipe,
Many thanks for this analysis.
It's possible, by your reading, that the extent of the cybercrime laws may
stretch even further than your scenario. For example: I use a personal
firewall; it provides (basic) protection, but it also means I would
"possess" information about an expoit attempt on my own computer. Wouldn't
that make me a transgressor?
OK, Linkers. The common complaint is that journalists ignore stories like
this; I open the floor to suggestions about how to relate this debate to Joe
Sixpack (since he's the voice that the pollies hear!).
Richard Chirgiwn
-----Original Message-----
From: felipe rodriquez [mailto:felipe@xs4all.nl]
Sent: Wednesday, 22 August 2001 17:25
To: Link
Subject: RE: [LINK] Australian Internet laws the butt of jokes worldwide
Hi,
> He warned Australia should tread carefully with the Cybercrime Bill 2001,
> considering past legislative mistakes in the area of technology.
There are severe problems with this bill for the computer security industry.
The Bill would make it illegal to possess or publish data that facilitates
unauthorized access to a computer. Lists like Bugtraq, where security
consultants worldwide discuss vulnerabilities would become illegal in
Australia. Because this mailinglist, and other mailinglists, often publish
exploits that expose security flaws. And publishing or owning this
information becomes illegal under the letter of this new law.
This Bill could possibly paralyze the Australian computer security industry,
because the tools of the trade will be banned by the government. Soon
devices that enable monitoring of site security, such as port scanners,
ethernet sniffers and exploits will be banned. Network managers will not be
able to do their job properly, without breaking the law, because they are
not allowed to own any of these tools.
Often this information, and the publication of exploits, is necessary to
encourage the computer industry to secure their software better. It has
happened on many occasions in the past that vulnerabilities of operating
systems where not fixed, despite the publisher having information about the
vulnerability. The publication of exploits forces the publisher to fix the
problem, instead of relying on security through obscurity.
An undesired effect effect of this bill is that computers in australia will
become less secure; the security industry will not be able to do its job
anymore, because security probes and the software used to probe, is no
longer allowed. Australian researchers will not be able to publish about
security flaws anymore, and will need to find a haven outside Australia.
Kind regards
Felipe Rodriquez
This archive was generated by hypermail 2.1.1 : Fri Aug 31 2001 - 03:10:05 EST