RE: Cybercrime treaty

[Russ <Russ.Cooper@rc.on.ca>]

Well, I definitely understand and appreciate not wanting to see the
underground driven any further away from the light of day than it already
is...but...aren't they (the Treaty writers) trying to do just that?

I mean, yes, we want to be able to see these things when they surface to be
able to figure out how to protect ourselves against them. Yet at the same
time, we must accept that the criminalization of some aspects of the
underground (and even some of those not part of the underground) must take
some form in order to (at least) discourage mafia boy's.

We can seek to have the Treaty language unambiguous...but I suspect that
could become a rat's nest as "industry experts" debate the verbiage (leaving
the Treaty writers believing that even we can't agree). Alternatively, we
can seek to include some sort of "special dispensation" type clause that
permits us to do what we do without fear. Those interacting with us can then
leverage our allowance to protect themselves (possibly endearing more of the
underground to one of our organizations).

If you take bomb-making as an analogy...one can design a bomb without (more
or less) hindrance. Anyone can construct some bombs without fear of
prosecution (I like my PVC tubing, hair spray, and apple bomb). Some can
construct "serious" bombs for licensed use (bullets, snow removing missiles,
etc...) Some can use "serious" bombs in licensed/permit situations (beaver
damn busting...etc...) But build a bomb and associate it with terrorist
materials (I have a pipe bomb and scribbling that describe me blowing up my
school) and you're into criminal action. Use it for such criminal purposes
and you're completely illegal.

While the fact that some aspects of bombs is illegal may hinder bomb squads
(to varying extents) from being able to disarm bombs they find, its better
than making them legal.

We may not want to drive the underground deeper, but we must accept that
society is none-to-pleased with the idea that we might be fostering,
encouraging, or even accepting of the actions of some, whom they see, akin
to mafia boy. Appreciate that we, as an industry, have done a terrible job
at preparing society for our ideas. Many companies have used the image that
the name mafia boy conveys as marketing fodder (NAI's pierced hacker comes
to mind.) As such, its going to be a hard slog to convince them that some of
these underground folks are actually beneficial to life. Look at Mudge's
persona as portrayed by the media for an example.

A thief is a criminal. Put him to work with a security firm to devise better
ways to protect a bank and he's a consultant. If thieves were getting into
too many banks, would we legalize it in the hope we'd get better at catching
them? I think not.

Clinton's idea is to take these cyber-criminals and send them to school,
then onto a cyber-peace corps. NewEconomy.com's idea is to offer him
options, a T1 and a shiny new laptop. With more than 1 million vacant IT
positions in the U.S. alone, its pretty clear that these criminals are in
great demand. With such incentive abounding to lure someone from the dark
side, those that don't want to come have to been seen as "hard core", no? If
they are "hard core", do we even talk to them today? Are we likely to? Will
we lose anything (will their perception of themselves change) if we label
them as criminals?

I'm sorry, I've gone on too long already. I'll try not to say anything more
on the list until more have chimed in (I'll reply to any comments in
private.)

Cheers,
Russ - NTBugtraq Editor
"dot-age" (as in "we're in the dot-age") = senility (source Webster's)