Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


New Laws Don't Solve Global Problems

US, Germany advance legislation against spyware, spam - but can't do much to stop foreign exploits

Legislators around the world are taking a stab at the computer crime problem. But experts say, in most cases, they don't have enough jurisdiction to solve it.

The U.S. House of Representatives made a splash last week by passing the Internet Spyware Prevention Act of 2007 and the Spy Act, two bills designed to reduce the use of spyware and give law enforcement more resources to pursue and prosecute spyware perpetrators.

At the same time, German legislators were passing a controversial new anti-cybercrime measure that defines hacking as penetrating a computer security system and gaining access to secure data, without necessarily stealing it. Offenders are defined as any individual or group that intentionally creates, spreads, or purchases hacker tools designed for illegal purposes. The law also extends prosecution to those who attack individuals, as well as businesses or government.

Both the U.S. and German legislation have aroused criticism. While the "I-Spy Act" would add $10 million to the Department of Justice's coffers for investigating spyware-related crimes and would increase penalties for offenders, it doesn't actually criminalize anything new. The Spy Act, on the other hand, outlines specifics on what organizations can and can't do with spyware, but experts say the legislation may be too specific.

"As it's currently written, the Spy Act does some good things, such as defining specifically what notice must be given to the user before installing software that tracks personal data, such as cookies," says Chris Pierson, founder of the cybersecurity and cyberliability practice at Lewis and Roca LLC, an Ariz. law firm.

"But what's troubling about the Spy Act is that a lot of it focuses on current technologies and practices that shift and change constantly," Pierson says. "For example, it talks about cookies, but it doesn't say anything about Web beacons or JavaScript or other technologies that might be just around the bend."

The German government, meanwhile, has come under fire from security researchers and ethical hackers who say the wording of its legislation is so strict that it outlaws their efforts to identify vulnerabilities and fix them. The new legislation will also make it easier for law enforcement agencies to install spyware on the computers of suspected cybercriminals, they complain.

Yet while legislators and their constituents on both sides of the Atlantic argue these points, legal experts say they are still missing a larger problem: The new laws won't do much to stop spyware or other forms of cybercrime at an international level where it's creating the most pain.

"It's a huge problem for us," says Pierson. "In cases that involve multiple countries, it's still incredibly hard to get cooperation among courts and law enforcement agencies so that you can pursue and prosecute. And if nothing is done to prosecute, you can bet businesses will be at greater and greater risk from criminals."

Less than two weeks ago, the International Telecommunications Union -- a subgroup of the United Nations that sets many international global technology standards -- attacked the international problem with the unveiling of the Global Cybersecurity Agenda, a broad initiative designed to help countries seal some of the holes in the patchwork of cybercrime laws across the world.

In addition to creating better interoperability among national laws, the ITU proposes to create a program for certifying that software and systems meet minimum security requirements. The GCA also includes initiatives for monitoring and alerting users to cybercrime, building law enforcement efforts to stop it, and a global identity management scheme that would work across national borders.

Unfortunately, like most ITU efforts, the GCA has been placed on an incredibly long timeline. The GCA will begin with a two-year study period, and the actual agenda will not be finalized -- much less acted upon -- until 2009.

In the meantime, Pierson says, the legislation created by countries such as the U.S. and Germany will be limited in its effectiveness. "It is possible to prosecute a criminal in another country if they violate, say, U.S. laws," he observes. "But that involves cooperation of law enforcement, extradition issues, and a lot of other issues. Realistically, we'll see criminals hiding behind other countries for a long time to come."

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-12-02
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
PUBLISHED: 2020-12-02
Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
PUBLISHED: 2020-12-02
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access,...
PUBLISHED: 2020-12-02
HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system.
PUBLISHED: 2020-12-02
An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat ...