Comments on: Hacking Techniques for Law Enforcement - A good idea or asking for trouble? http://www.tssci-security.com/archives/2007/06/05/hacking-techniques-for-law-enforcement-a-good-idea-or-asking-for-trouble/ top secret/secure computing information Fri, 21 Nov 2008 19:25:15 +0000 http://wordpress.org/?v=2.2.3 By: Mars http://www.tssci-security.com/archives/2007/06/05/hacking-techniques-for-law-enforcement-a-good-idea-or-asking-for-trouble/#comment-811 Mars Wed, 06 Jun 2007 18:36:35 +0000 http://www.tssci-security.com/archives/2007/06/05/hacking-techniques-for-law-enforcement-a-good-idea-or-asking-for-trouble/#comment-811 Great point man, I'd assert that at least in the beginning, training law enforcement would be a much less viable solution than outsourcing that talent, for the exact reasons you mention: cost effectiveness, and whether advanced tactics will be executable by the authorities charged with the task without destroying data or otherwise damaging a functional system, let alone whether it would yield useful results at all. On the other hand, I think it's clear we've (the collective we) identified that cyber-communication enables cyber-terrorism, and I do believe that we need an organized method of dealing with it. I think that the development of technology to this point has raised many white-grey-black hat perspective questions, and now that the technology is getting popular enough to entice cyber terrorism, governments will have to ask themselves the same questions the OG (original gangsta) hackers asked themselves when they realized they had a leg-up on the typical dumb user's sensitive data. I believe that in order to answer this "should law enforcement be able to use security tools" question, we need to better understand how the current laws work with technology (we know big brother isn't going to strike a few ancient perhaps even deprecated lines in a law just because technology has changed the world .... but they should lol). This brings me full circle, back to what Germany decided to do about this: nothing, because they don't know enough to ratify a legal framework for it. However, in the interest of minimizing "cyberterrorism" (air quotes lol) I think law enforcement agencies should be able to use security tools that do not access computers in a way that breaches privacy. Doing a quick Nmap scan is as harmless as driving by someone's house to see if they left their windows open. Should law enforcement be prohibited to use even that? Perhaps with a warrant, and due diligence to communicate the necessity of the warrant like was mentioned in the original post, penetration tools could be utilized. I think it would be much easier for us here in the US to throw out laws that prohibit us from properly securing our systems such that law enforcement can't penetrate and plant\steal\destroy data. I'm worried other countries may not find see this as a problem :( hmm ... there is a lot to think about... -Mars Great point man, I’d assert that at least in the beginning, training law enforcement would be a much less viable solution than outsourcing that talent, for the exact reasons you mention: cost effectiveness, and whether advanced tactics will be executable by the authorities charged with the task without destroying data or otherwise damaging a functional system, let alone whether it would yield useful results at all.

On the other hand, I think it’s clear we’ve (the collective we) identified that cyber-communication enables cyber-terrorism, and I do believe that we need an organized method of dealing with it. I think that the development of technology to this point has raised many white-grey-black hat perspective questions, and now that the technology is getting popular enough to entice cyber terrorism, governments will have to ask themselves the same questions the OG (original gangsta) hackers asked themselves when they realized they had a leg-up on the typical dumb user’s sensitive data.

I believe that in order to answer this “should law enforcement be able to use security tools” question, we need to better understand how the current laws work with technology (we know big brother isn’t going to strike a few ancient perhaps even deprecated lines in a law just because technology has changed the world …. but they should lol). This brings me full circle, back to what Germany decided to do about this: nothing, because they don’t know enough to ratify a legal framework for it.

However, in the interest of minimizing “cyberterrorism” (air quotes lol) I think law enforcement agencies should be able to use security tools that do not access computers in a way that breaches privacy. Doing a quick Nmap scan is as harmless as driving by someone’s house to see if they left their windows open. Should law enforcement be prohibited to use even that? Perhaps with a warrant, and due diligence to communicate the necessity of the warrant like was mentioned in the original post, penetration tools could be utilized.

I think it would be much easier for us here in the US to throw out laws that prohibit us from properly securing our systems such that law enforcement can’t penetrate and plant\steal\destroy data. I’m worried other countries may not find see this as a problem :(

hmm … there is a lot to think about…
-Mars

]]>