Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


New Laws Don't Solve Global Problems

US, Germany advance legislation against spyware, spam - but can't do much to stop foreign exploits

Legislators around the world are taking a stab at the computer crime problem. But experts say, in most cases, they don't have enough jurisdiction to solve it.

The U.S. House of Representatives made a splash last week by passing the Internet Spyware Prevention Act of 2007 and the Spy Act, two bills designed to reduce the use of spyware and give law enforcement more resources to pursue and prosecute spyware perpetrators.

At the same time, German legislators were passing a controversial new anti-cybercrime measure that defines hacking as penetrating a computer security system and gaining access to secure data, without necessarily stealing it. Offenders are defined as any individual or group that intentionally creates, spreads, or purchases hacker tools designed for illegal purposes. The law also extends prosecution to those who attack individuals, as well as businesses or government.

Both the U.S. and German legislation have aroused criticism. While the "I-Spy Act" would add $10 million to the Department of Justice's coffers for investigating spyware-related crimes and would increase penalties for offenders, it doesn't actually criminalize anything new. The Spy Act, on the other hand, outlines specifics on what organizations can and can't do with spyware, but experts say the legislation may be too specific.

"As it's currently written, the Spy Act does some good things, such as defining specifically what notice must be given to the user before installing software that tracks personal data, such as cookies," says Chris Pierson, founder of the cybersecurity and cyberliability practice at Lewis and Roca LLC, an Ariz. law firm.

"But what's troubling about the Spy Act is that a lot of it focuses on current technologies and practices that shift and change constantly," Pierson says. "For example, it talks about cookies, but it doesn't say anything about Web beacons or JavaScript or other technologies that might be just around the bend."

The German government, meanwhile, has come under fire from security researchers and ethical hackers who say the wording of its legislation is so strict that it outlaws their efforts to identify vulnerabilities and fix them. The new legislation will also make it easier for law enforcement agencies to install spyware on the computers of suspected cybercriminals, they complain.

Yet while legislators and their constituents on both sides of the Atlantic argue these points, legal experts say they are still missing a larger problem: The new laws won't do much to stop spyware or other forms of cybercrime at an international level where it's creating the most pain.

"It's a huge problem for us," says Pierson. "In cases that involve multiple countries, it's still incredibly hard to get cooperation among courts and law enforcement agencies so that you can pursue and prosecute. And if nothing is done to prosecute, you can bet businesses will be at greater and greater risk from criminals."

Less than two weeks ago, the International Telecommunications Union -- a subgroup of the United Nations that sets many international global technology standards -- attacked the international problem with the unveiling of the Global Cybersecurity Agenda, a broad initiative designed to help countries seal some of the holes in the patchwork of cybercrime laws across the world.

In addition to creating better interoperability among national laws, the ITU proposes to create a program for certifying that software and systems meet minimum security requirements. The GCA also includes initiatives for monitoring and alerting users to cybercrime, building law enforcement efforts to stop it, and a global identity management scheme that would work across national borders.

Unfortunately, like most ITU efforts, the GCA has been placed on an incredibly long timeline. The GCA will begin with a two-year study period, and the actual agenda will not be finalized -- much less acted upon -- until 2009.

In the meantime, Pierson says, the legislation created by countries such as the U.S. and Germany will be limited in its effectiveness. "It is possible to prosecute a criminal in another country if they violate, say, U.S. laws," he observes. "But that involves cooperation of law enforcement, extradition issues, and a lot of other issues. Realistically, we'll see criminals hiding behind other countries for a long time to come."

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.