Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


New Laws Don't Solve Global Problems

US, Germany advance legislation against spyware, spam - but can't do much to stop foreign exploits

Legislators around the world are taking a stab at the computer crime problem. But experts say, in most cases, they don't have enough jurisdiction to solve it.

The U.S. House of Representatives made a splash last week by passing the Internet Spyware Prevention Act of 2007 and the Spy Act, two bills designed to reduce the use of spyware and give law enforcement more resources to pursue and prosecute spyware perpetrators.

At the same time, German legislators were passing a controversial new anti-cybercrime measure that defines hacking as penetrating a computer security system and gaining access to secure data, without necessarily stealing it. Offenders are defined as any individual or group that intentionally creates, spreads, or purchases hacker tools designed for illegal purposes. The law also extends prosecution to those who attack individuals, as well as businesses or government.

Both the U.S. and German legislation have aroused criticism. While the "I-Spy Act" would add $10 million to the Department of Justice's coffers for investigating spyware-related crimes and would increase penalties for offenders, it doesn't actually criminalize anything new. The Spy Act, on the other hand, outlines specifics on what organizations can and can't do with spyware, but experts say the legislation may be too specific.

"As it's currently written, the Spy Act does some good things, such as defining specifically what notice must be given to the user before installing software that tracks personal data, such as cookies," says Chris Pierson, founder of the cybersecurity and cyberliability practice at Lewis and Roca LLC, an Ariz. law firm.

"But what's troubling about the Spy Act is that a lot of it focuses on current technologies and practices that shift and change constantly," Pierson says. "For example, it talks about cookies, but it doesn't say anything about Web beacons or JavaScript or other technologies that might be just around the bend."

The German government, meanwhile, has come under fire from security researchers and ethical hackers who say the wording of its legislation is so strict that it outlaws their efforts to identify vulnerabilities and fix them. The new legislation will also make it easier for law enforcement agencies to install spyware on the computers of suspected cybercriminals, they complain.

Yet while legislators and their constituents on both sides of the Atlantic argue these points, legal experts say they are still missing a larger problem: The new laws won't do much to stop spyware or other forms of cybercrime at an international level where it's creating the most pain.

"It's a huge problem for us," says Pierson. "In cases that involve multiple countries, it's still incredibly hard to get cooperation among courts and law enforcement agencies so that you can pursue and prosecute. And if nothing is done to prosecute, you can bet businesses will be at greater and greater risk from criminals."

Less than two weeks ago, the International Telecommunications Union -- a subgroup of the United Nations that sets many international global technology standards -- attacked the international problem with the unveiling of the Global Cybersecurity Agenda, a broad initiative designed to help countries seal some of the holes in the patchwork of cybercrime laws across the world.

In addition to creating better interoperability among national laws, the ITU proposes to create a program for certifying that software and systems meet minimum security requirements. The GCA also includes initiatives for monitoring and alerting users to cybercrime, building law enforcement efforts to stop it, and a global identity management scheme that would work across national borders.

Unfortunately, like most ITU efforts, the GCA has been placed on an incredibly long timeline. The GCA will begin with a two-year study period, and the actual agenda will not be finalized -- much less acted upon -- until 2009.

In the meantime, Pierson says, the legislation created by countries such as the U.S. and Germany will be limited in its effectiveness. "It is possible to prosecute a criminal in another country if they violate, say, U.S. laws," he observes. "But that involves cooperation of law enforcement, extradition issues, and a lot of other issues. Realistically, we'll see criminals hiding behind other countries for a long time to come."

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-20
** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.