RE: [BOARD] Status of CyberCrime treaty statement

[David LeBlanc <dleblanc@microsoft.com>]

Right, which is why the wisest course is to regulate conduct. It is quite
possible to define "system that doesn't belong to me" and "attack".  Once
you start getting into the question of tools, we start dealing with vague
clauses that are left open to interpretation, trampling of free speech
rights, and the possibility of putting legal barriers in the way of people
who are trying to protect you. After all, we're likely to pay attention to
the laws.

For example, a coat hanger can be used to break into cars. Mechanics quite
often possess a "slim jim" set which are sophisticated coat hangers. We
don't have laws against possession of these objects, whether the person
possessing them has criminal intent or not. USING these objects on a vehicle
where you do not have permission from the owner IS illegal and rightfully
so. Planning to use the objects in a criminal manner is conspiracy and is
also illegal.  Possession of the objects may be considered evidence, but it
is NOT illegal.

These types of crimes are no different, and should not be treated any
differently.  I would really find it onerous to have to go check with legal
every time I hit the compile button, and that's where we're headed.

> -----Original Message-----
> From: Marcus J. Ranum [mailto:mjr@nfr.net]
> Sent: Tuesday, June 27, 2000 6:51 AM
> To: David LeBlanc; 'Scott Blake';
> cve-editorial-board-list@lists.mitre.org
> Subject: RE: [BOARD] Status of CyberCrime treaty statement
>
>
>
> >The treaty needs to EXPLICITLY allow for white hat
> activities and research.
>
> That's also impossible to define such as not to allow loopholes.
>
> mjr.
>
> -----
> Marcus J. Ranum
> Chief Technology Officer, Network Flight Recorder, Inc.
> Work:                  http://www.nfr.net
> Personal:              http://pubweb.nfr.net/~mjr
>