New Laws Don't Solve Global Problems

Legislators around the world are taking a stab at the computer crime problem. But experts say, in most cases, they don't have enough jurisdiction to solve it.

The U.S. House of Representatives made a splash last week by passing the Internet Spyware Prevention Act of 2007 and the Spy Act, two bills designed to reduce the use of spyware and give law enforcement more resources to pursue and prosecute spyware perpetrators.

At the same time, German legislators were passing a controversial new anti-cybercrime measure that defines hacking as penetrating a computer security system and gaining access to secure data, without necessarily stealing it. Offenders are defined as any individual or group that intentionally creates, spreads, or purchases hacker tools designed for illegal purposes. The law also extends prosecution to those who attack individuals, as well as businesses or government.

Both the U.S. and German legislation have aroused criticism. While the "I-Spy Act" would add $10 million to the Department of Justice's coffers for investigating spyware-related crimes and would increase penalties for offenders, it doesn't actually criminalize anything new. The Spy Act, on the other hand, outlines specifics on what organizations can and can't do with spyware, but experts say the legislation may be too specific.

"As it's currently written, the Spy Act does some good things, such as defining specifically what notice must be given to the user before installing software that tracks personal data, such as cookies," says Chris Pierson, founder of the cybersecurity and cyberliability practice at Lewis and Roca LLC, an Ariz. law firm.

"But what's troubling about the Spy Act is that a lot of it focuses on current technologies and practices that shift and change constantly," Pierson says. "For example, it talks about cookies, but it doesn't say anything about Web beacons or JavaScript or other technologies that might be just around the bend."

The German government, meanwhile, has come under fire from security researchers and ethical hackers who say the wording of its legislation is so strict that it outlaws their efforts to identify vulnerabilities and fix them. The new legislation will also make it easier for law enforcement agencies to install spyware on the computers of suspected cybercriminals, they complain.

Yet while legislators and their constituents on both sides of the Atlantic argue these points, legal experts say they are still missing a larger problem: The new laws won't do much to stop spyware or other forms of cybercrime at an international level where it's creating the most pain.

"It's a huge problem for us," says Pierson. "In cases that involve multiple countries, it's still incredibly hard to get cooperation among courts and law enforcement agencies so that you can pursue and prosecute. And if nothing is done to prosecute, you can bet businesses will be at greater and greater risk from criminals."

Less than two weeks ago, the International Telecommunications Union -- a subgroup of the United Nations that sets many international global technology standards -- attacked the international problem with the unveiling of the Global Cybersecurity Agenda, a broad initiative designed to help countries seal some of the holes in the patchwork of cybercrime laws across the world.

In addition to creating better interoperability among national laws, the ITU proposes to create a program for certifying that software and systems meet minimum security requirements. The GCA also includes initiatives for monitoring and alerting users to cybercrime, building law enforcement efforts to stop it, and a global identity management scheme that would work across national borders.

Unfortunately, like most ITU efforts, the GCA has been placed on an incredibly long timeline. The GCA will begin with a two-year study period, and the actual agenda will not be finalized -- much less acted upon -- until 2009.

In the meantime, Pierson says, the legislation created by countries such as the U.S. and Germany will be limited in its effectiveness. "It is possible to prosecute a criminal in another country if they violate, say, U.S. laws," he observes. "But that involves cooperation of law enforcement, extradition issues, and a lot of other issues. Realistically, we'll see criminals hiding behind other countries for a long time to come."

— Tim Wilson, Site Editor, Dark Reading