Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


New Laws Don't Solve Global Problems

US, Germany advance legislation against spyware, spam - but can't do much to stop foreign exploits

Legislators around the world are taking a stab at the computer crime problem. But experts say, in most cases, they don't have enough jurisdiction to solve it.

The U.S. House of Representatives made a splash last week by passing the Internet Spyware Prevention Act of 2007 and the Spy Act, two bills designed to reduce the use of spyware and give law enforcement more resources to pursue and prosecute spyware perpetrators.

At the same time, German legislators were passing a controversial new anti-cybercrime measure that defines hacking as penetrating a computer security system and gaining access to secure data, without necessarily stealing it. Offenders are defined as any individual or group that intentionally creates, spreads, or purchases hacker tools designed for illegal purposes. The law also extends prosecution to those who attack individuals, as well as businesses or government.

Both the U.S. and German legislation have aroused criticism. While the "I-Spy Act" would add $10 million to the Department of Justice's coffers for investigating spyware-related crimes and would increase penalties for offenders, it doesn't actually criminalize anything new. The Spy Act, on the other hand, outlines specifics on what organizations can and can't do with spyware, but experts say the legislation may be too specific.

"As it's currently written, the Spy Act does some good things, such as defining specifically what notice must be given to the user before installing software that tracks personal data, such as cookies," says Chris Pierson, founder of the cybersecurity and cyberliability practice at Lewis and Roca LLC, an Ariz. law firm.

"But what's troubling about the Spy Act is that a lot of it focuses on current technologies and practices that shift and change constantly," Pierson says. "For example, it talks about cookies, but it doesn't say anything about Web beacons or JavaScript or other technologies that might be just around the bend."

The German government, meanwhile, has come under fire from security researchers and ethical hackers who say the wording of its legislation is so strict that it outlaws their efforts to identify vulnerabilities and fix them. The new legislation will also make it easier for law enforcement agencies to install spyware on the computers of suspected cybercriminals, they complain.

Yet while legislators and their constituents on both sides of the Atlantic argue these points, legal experts say they are still missing a larger problem: The new laws won't do much to stop spyware or other forms of cybercrime at an international level where it's creating the most pain.

"It's a huge problem for us," says Pierson. "In cases that involve multiple countries, it's still incredibly hard to get cooperation among courts and law enforcement agencies so that you can pursue and prosecute. And if nothing is done to prosecute, you can bet businesses will be at greater and greater risk from criminals."

Less than two weeks ago, the International Telecommunications Union -- a subgroup of the United Nations that sets many international global technology standards -- attacked the international problem with the unveiling of the Global Cybersecurity Agenda, a broad initiative designed to help countries seal some of the holes in the patchwork of cybercrime laws across the world.

In addition to creating better interoperability among national laws, the ITU proposes to create a program for certifying that software and systems meet minimum security requirements. The GCA also includes initiatives for monitoring and alerting users to cybercrime, building law enforcement efforts to stop it, and a global identity management scheme that would work across national borders.

Unfortunately, like most ITU efforts, the GCA has been placed on an incredibly long timeline. The GCA will begin with a two-year study period, and the actual agenda will not be finalized -- much less acted upon -- until 2009.

In the meantime, Pierson says, the legislation created by countries such as the U.S. and Germany will be limited in its effectiveness. "It is possible to prosecute a criminal in another country if they violate, say, U.S. laws," he observes. "But that involves cooperation of law enforcement, extradition issues, and a lot of other issues. Realistically, we'll see criminals hiding behind other countries for a long time to come."

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-13
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5....
PUBLISHED: 2020-07-13
The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.
PUBLISHED: 2020-07-13
The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.